CVE-2026-35346: uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::fromutf8lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_commto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35346?
CVE-2026-35346 is classified as a moderate severity vulnerability due to the risk of silent data corruption.
How do I fix CVE-2026-35346?
To fix CVE-2026-35346, update to the latest version of uutils coreutils where the issue is resolved.
What type of vulnerability is CVE-2026-35346?
CVE-2026-35346 is a data corruption vulnerability caused by lossy UTF-8 normalization.
Which software is affected by CVE-2026-35346?
CVE-2026-35346 affects the uutils coreutils package.
What is the impact of CVE-2026-35346?
The impact of CVE-2026-35346 is the potential loss of data integrity when using the comm utility.