UBUNTU-CVE-2026-35348: Medium severity ubuntu/rust-coreutils vulnerability
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1 - Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu2~26.04.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the uutils coreutils implementation of sort are exposed when sort is invoked with --files0-from and the supplied NUL-delimited input includes a filename that is not valid UTF-8. The impact is local disruption of automated pipelines that use this option.
What does an attacker need to trigger the crash?
The attacker needs local access sufficient to cause a vulnerable sort invocation to process attacker-controlled input through --files0-from. That input must contain at least one valid filesystem path whose filename has non-UTF-8 bytes.
Is the default sort behavior affected?
The provided information identifies the vulnerable path specifically as use of --files0-from. It does not indicate that ordinary sort invocations without this option are affected.
How can I determine whether a pipeline is at risk?
Review jobs, scripts, and services that invoke rust-coreutils sort with --files0-from. They are at risk if the NUL-delimited filename source can include non-UTF-8 filenames, particularly from attacker-influenced directories or archives.