3.3

CVE-2026-35346

Exploit

uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Uutils ≫ Coreutils SwPlatformrust Version < 0.6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.072
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@ubuntu.com 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-176 Improper Handling of Unicode Encoding

The product does not properly handle when an input contains Unicode encoding.

https://github.com/uutils/coreutils/releases/tag/0.6.0
Release Notes
https://github.com/uutils/coreutils/pull/10206
Patch
Issue Tracking
https://github.com/uutils/coreutils/issues/10192
Vendor Advisory
Exploit
Issue Tracking