CVE-2026-35371

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-451

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-353725.0A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference CVE-2026-353735.5A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when usingCVE-2026-353746.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data CVE-2026-353753.3A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffCVE-2026-353765.8A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The impleCVE-2026-353773.3A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (splitCVE-2026-353783.3A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rCVE-2026-353793.3A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. CVE-2026-35388.8Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acceCVE-2026-353805.5A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single CVE-2026-353813.3A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-termiCVE-2026-353836.5Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this
CVE-2026-35371: Low severity, CVSS 3.3 | Vulnix