Medium severity5.5NVD Advisory· Published Apr 22, 2026· Updated Apr 24, 2026
CVE-2026-35348
CVE-2026-35348
Description
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
coreutilscrates.io | <= 0.8.0 | — |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/uutils/coreutils/issues/9696nvdExploitIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-f2jv-wjjc-2c94ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-35348ghsaADVISORY
News mentions
0No linked articles in our index yet.