CVE Feed

    Dashboard / CVE / CVE-2026-35348

    CVE-2026-35348

    The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

    Published:Apr 22, 2026
    Last Modified:Apr 24, 2026
    EPS:Apr 22, 2026
    EPSS Score:0.00013
    CVSS Score:5.5

    Affected Products

    Vendor
    Uutils
    Product
    Coreutils

    Exploits

    https://github.com/uutils/coreutils/issues/9696https://github.com/uutils/coreutils/issues/9696

    Common Weakness Enumeration

    CWE-248 Uncaught Exception

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-35381 (CVSS 3.3) — A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag…
    CVE-2026-35380 (CVSS 5.5) — A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal t…
    CVE-2026-35379 (CVSS 3.3) — A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and…
    CVE-2026-35378 (CVSS 3.3) — A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressi…
    CVE-2026-35377 (CVSS 3.3) — A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line argument…
    CVE-2026-35376 (CVSS 4.5) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during r…
    CVE-2026-35375 (CVSS 3.3) — A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided…
    CVE-2026-35374 (CVSS 6.3) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The pro…
    CVE-2026-35373 (CVSS 3.3) — A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-U…
    CVE-2026-35372 (CVSS 5) — A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High