CVE-2026-35381 uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering

What is CVE-2026-35381?

CVE-2026-35381 is a low-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.

Weakness: CWE-684

Which versions are affected by CVE-2026-35381?

2 open source packages ship an affected version, including uu_cut. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35381?

Upgrade uu_cut to 0.8.0 or later.

Is CVE-2026-35381 being exploited?

There is no known exploitation of CVE-2026-35381 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35381, GHSA-pmfc-4wjj-gmhx, UBUNTU-CVE-2026-35381.