CVE-2026-35348

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-353497.7A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-stri CVE-2026-35359.8The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGV CVE-2026-353506.6The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the CVE-2026-353514.2The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls b CVE-2026-353527.0A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then CVE-2026-353533.3The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived perm CVE-2026-353544.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended a CVE-2026-353556.3The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. Th CVE-2026-353566.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command CVE-2026-353574.7The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with u CVE-2026-353585.5The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sou CVE-2026-353594.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference inte