CVE-2026-35346 uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization

What is CVE-2026-35346?

CVE-2026-35346 is a low-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Weakness: CWE-176

Which versions are affected by CVE-2026-35346?

2 open source packages ship an affected version, including uu_comm. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35346?

Upgrade uu_comm to 0.6.0 or later.

Is CVE-2026-35346 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35346 exists.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35346, GHSA-6gcw-w7cp-94g9, UBUNTU-CVE-2026-35346.