CVE-2026-35348: uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35348?
The severity of CVE-2026-35348 is rated as medium with a score of 5.5.
How do I fix CVE-2026-35348?
To fix CVE-2026-35348, avoid using the --files0-from option with non-UTF-8 filenames in the sort utility.
What type of vulnerability is CVE-2026-35348?
CVE-2026-35348 is categorized as a Local Denial of Service vulnerability affecting the sort utility in uutils coreutils.
Which software is affected by CVE-2026-35348?
The software affected by CVE-2026-35348 is uutils coreutils, specifically the sort utility.
What effect does CVE-2026-35348 have on systems?
CVE-2026-35348 can lead to a process panic and crash the sort utility when encountering valid non-UTF-8 filenames.