CVE-2026-35380: uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing
A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35380?
CVE-2026-35380 is classified as a local logic error and data integrity issue that affects the delimiter parsing in the uutils coreutils cut utility.
How do I fix CVE-2026-35380?
To fix CVE-2026-35380, update to the latest version of uutils coreutils that addresses this logic error.
What are the potential impacts of CVE-2026-35380?
CVE-2026-35380 may lead to incorrect interpretations of delimiter inputs, potentially compromising data integrity.
Which versions of uutils coreutils are affected by CVE-2026-35380?
CVE-2026-35380 affects versions of uutils coreutils prior to the fix included in release 0.8.0.
Is CVE-2026-35380 exploitable by local users?
Yes, CVE-2026-35380 can be exploited by local users who utilize the cut utility with improperly formatted delimiters.