CVE-2026-35380

A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/pull/11399	Exploit Issue Tracking Patch
https://github.com/uutils/coreutils/releases/tag/0.8.0	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Un error lógico en la utilidad cut de uutils coreutils hace que el programa interprete incorrectamente la cadena literal de dos bytes ’’ (dos comillas simples) como un delimitador vacío. La implementación mapea erróneamente esta cadena al carácter NUL tanto para las opciones -d (delimitador) como --output-delimiter. Esta vulnerabilidad puede llevar a una corrupción silenciosa de datos o a errores lógicos en scripts automatizados y pipelines de datos que procesan cadenas que contienen estos caracteres, ya que la utilidad puede dividir o unir datos involuntariamente en bytes NUL en lugar de los caracteres literales previstos.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35380

Mitre link : CVE-2026-35380

CVE.ORG link : CVE-2026-35380

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2026-35380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35380", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T16:53:51.376352Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "versions": [{"status": "affected", "version": "0", "lessThan": "0.8.0", "versionType": "semver"}], "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "unaffected"}]}], "published": "2026-04-22T17:16:43.047", "references": [{"url": "https://github.com/uutils/coreutils/pull/11399", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/releases/tag/0.8.0", "tags": ["Release Notes"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters."}, {"lang": "es", "value": "Un error l\u00f3gico en la utilidad cut de uutils coreutils hace que el programa interprete incorrectamente la cadena literal de dos bytes \u2019\u2019 (dos comillas simples) como un delimitador vac\u00edo. La implementaci\u00f3n mapea err\u00f3neamente esta cadena al car\u00e1cter NUL tanto para las opciones -d (delimitador) como --output-delimiter. Esta vulnerabilidad puede llevar a una corrupci\u00f3n silenciosa de datos o a errores l\u00f3gicos en scripts automatizados y pipelines de datos que procesan cadenas que contienen estos caracteres, ya que la utilidad puede dividir o unir datos involuntariamente en bytes NUL en lugar de los caracteres literales previstos."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "2365DBBD-6F10-4651-8DA4-08AE79E14423", "versionEndExcluding": "0.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}