CVE-2026-35373

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/pull/11403	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un error lógico en la utilidad ln de uutils coreutils hace que el programa rechace rutas de origen que contienen bytes de nombre de archivo que no son UTF-8 al usar formas de directorio de destino (p. ej., ln ORIGEN... DIRECTORIO). Mientras que GNU ln trata los nombres de archivo como bytes sin procesar y crea los enlaces correctamente, la implementación de uutils impone la codificación UTF-8, lo que resulta en un fallo al hacer stat al archivo y un código de salida distinto de cero. En entornos donde scripts automatizados o tareas del sistema procesan nombres de archivo válidos pero no UTF-8, comunes en sistemas de archivos Unix, esta divergencia hace que la utilidad falle, lo que lleva a una denegación de servicio local para esas operaciones específicas.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35373

Mitre link : CVE-2026-35373

CVE.ORG link : CVE-2026-35373

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-176

Improper Handling of Unicode Encoding

{"id": "CVE-2026-35373", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35373", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:19:57.514800Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:41.997", "references": [{"url": "https://github.com/uutils/coreutils/pull/11403", "tags": ["Exploit", "Issue Tracking"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-176"}]}], "descriptions": [{"lang": "en", "value": "A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations."}, {"lang": "es", "value": "Un error l\u00f3gico en la utilidad ln de uutils coreutils hace que el programa rechace rutas de origen que contienen bytes de nombre de archivo que no son UTF-8 al usar formas de directorio de destino (p. ej., ln ORIGEN... DIRECTORIO). Mientras que GNU ln trata los nombres de archivo como bytes sin procesar y crea los enlaces correctamente, la implementaci\u00f3n de uutils impone la codificaci\u00f3n UTF-8, lo que resulta en un fallo al hacer stat al archivo y un c\u00f3digo de salida distinto de cero. En entornos donde scripts automatizados o tareas del sistema procesan nombres de archivo v\u00e1lidos pero no UTF-8, comunes en sistemas de archivos Unix, esta divergencia hace que la utilidad falle, lo que lleva a una denegaci\u00f3n de servicio local para esas operaciones espec\u00edficas."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}