CVE-2026-35375 Details
Description
A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.
A logic error has been identified in the split utility of uutils coreutils, specifically in version 0.8.0. This vulnerability causes output filenames to become corrupted when non-UTF-8 prefix or suffix inputs are used. The issue arises because the implementation relies on to_string_lossy() to construct chunk filenames, which alters invalid byte sequences into the UTF-8 replacement character. This behavior is inconsistent with GNU split, which maintains the integrity of raw pathname bytes. In non-UTF-8 encoding environments, this vulnerability can result in incorrect file names, potentially leading to filename collisions, disrupted automation, or misdirected output data.
Users can upgrade to uutils coreutils version 0.8.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/11397 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.8.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-176 | Improper Handling of Unicode Encoding | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.8.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |