CVE-2026-35370

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
Uutilscoreutils—

References

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-353713.3The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The CVE-2026-353725.0A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference CVE-2026-353735.5A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when usingCVE-2026-353746.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data CVE-2026-353753.3A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffCVE-2026-353765.8A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The impleCVE-2026-353773.3A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (splitCVE-2026-353783.3A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rCVE-2026-353793.3A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. CVE-2026-35388.8Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acceCVE-2026-353805.5A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single CVE-2026-353813.3A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-termi
CVE-2026-35370: Medium severity, CVSS 4.4 | Vulnix