CVE-2026-35379 Details
Description
A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.
A logic error has been identified in the tr utility of uutils coreutils, specifically in version 0.8.0. This error causes the program to misinterpret the [:graph:] and [:print:] character classes. The implementation erroneously includes the ASCII space character in the [:graph:] class while excluding it from the [:print:] class, thereby reversing the standard behavior defined by POSIX and GNU coreutils. As a result, when the utility is used in automated scripts or data-cleaning processes that depend on conventional character class meanings, it can lead to unintended data modification or loss. For instance, a command intended to remove all graphical characters while keeping whitespace will mistakenly delete all ASCII spaces, potentially causing data corruption or logical errors in subsequent processing.
Users can update to uutils coreutils version 0.8.1 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/11405 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.8.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-684 | Incorrect Provision of Specified Functionality | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.8.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |