CVE-2026-35348 uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing

What is CVE-2026-35348?

CVE-2026-35348 is a medium-severity denial of service vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Weakness: CWE-248

Which versions are affected by CVE-2026-35348?

2 open source packages ship an affected version, including coreutils. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35348?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-35348 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35348 exists.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35348, GHSA-f2jv-wjjc-2c94, UBUNTU-CVE-2026-35348.