CVE-2026-35347

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/pull/9545	Issue Tracking Patch
https://github.com/uutils/coreutils/releases/tag/0.6.0	Release Notes
https://github.com/uutils/coreutils/pull/9545	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La utilidad “comm” en “uutils coreutils” consume datos incorrectamente de entradas de archivos no regulares antes de realizar operaciones de comparación. La función “are_files_identical” abre y lee de ambas rutas de entrada para comparar el contenido sin verificar primero si las rutas se refieren a archivos regulares. Si una ruta de entrada es un FIFO o una tubería, esta operación de prelectura drena el flujo, lo que lleva a una pérdida silenciosa de datos antes de que se ejecute la lógica de comparación real. Además, la utilidad puede colgarse indefinidamente si intenta preleer de flujos infinitos como “/dev/zero”.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35347

Mitre link : CVE-2026-35347

CVE.ORG link : CVE-2026-35347

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-35347", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35347", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:11:26.303416Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "versions": [{"status": "affected", "version": "0", "lessThan": "0.6.0", "versionType": "semver"}], "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "unaffected"}]}], "published": "2026-04-22T17:16:36.903", "references": [{"url": "https://github.com/uutils/coreutils/pull/9545", "tags": ["Issue Tracking", "Patch"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0", "tags": ["Release Notes"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/pull/9545", "tags": ["Issue Tracking", "Patch"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero."}, {"lang": "es", "value": "La utilidad \u201ccomm\u201d en \u201cuutils coreutils\u201d consume datos incorrectamente de entradas de archivos no regulares antes de realizar operaciones de comparaci\u00f3n. La funci\u00f3n \u201care_files_identical\u201d abre y lee de ambas rutas de entrada para comparar el contenido sin verificar primero si las rutas se refieren a archivos regulares. Si una ruta de entrada es un FIFO o una tuber\u00eda, esta operaci\u00f3n de prelectura drena el flujo, lo que lleva a una p\u00e9rdida silenciosa de datos antes de que se ejecute la l\u00f3gica de comparaci\u00f3n real. Adem\u00e1s, la utilidad puede colgarse indefinidamente si intenta preleer de flujos infinitos como \u201c/dev/zero\u201d."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "87C33018-2E08-45B0-B69C-7FC224F7F883", "versionEndExcluding": "0.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}