CVE-2026-35346

LowCVSS 3.3/10Last modified Oct 26, 2026

Description

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-176

Affected software

Vendor	Product	Versions
Uutils	coreutils	< 0.6.0

References

https://github.com/uutils/coreutils/issues/10192Exploit, Issue Tracking, Vendor Advisory
https://github.com/uutils/coreutils/pull/10206Issue Tracking, Patch
https://github.com/uutils/coreutils/releases/tag/0.6.0Release Notes
https://github.com/uutils/coreutils/issues/10192Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Apr 22, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-353474.4The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are CVE-2026-353485.5The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 f CVE-2026-353497.7A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-stri CVE-2026-35359.8The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGV CVE-2026-353506.6The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the CVE-2026-353514.2The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls b CVE-2026-353527.0A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then CVE-2026-353533.3The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived perm CVE-2026-353544.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended a CVE-2026-353556.3The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. Th CVE-2026-353566.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command CVE-2026-353574.7The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with u