CVEvulnerability

CVE-2026-35348

5.5 MEDIUM Published 2026-04-22 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-04-22
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248

Description

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Affected configurations

• uutils coreutils

Related

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References