CVE-2026-35379: uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling
A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35379?
CVE-2026-35379 is classified as a logic error vulnerability in the uutils coreutils tr utility.
How do I fix CVE-2026-35379?
To fix CVE-2026-35379, update uutils coreutils to version 0.8.0 or later, which addresses the character class handling issue.
What are the potential impacts of CVE-2026-35379?
The potential impacts of CVE-2026-35379 include incorrect character class handling, leading to data integrity issues in processing text.
Which versions of uutils coreutils are affected by CVE-2026-35379?
CVE-2026-35379 affects versions of uutils coreutils prior to version 0.8.0.
Can CVE-2026-35379 lead to security breaches?
While primarily a logic error, CVE-2026-35379 could potentially allow for unexpected behavior in applications relying on the tr utility, which may lead to further security concerns.