CVE-2026-35346
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines.
Does this matter?
Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.
Description
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.
- CVSS 3.1
- 3.3 LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.18% probability · 7th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-176
- Affected
- uutils/coreutils
- Source
- security@ubuntu.com
References
- https://github.com/uutils/coreutils/issues/10192Exploit, Issue Tracking, Vendor Advisory
- https://github.com/uutils/coreutils/pull/10206Issue Tracking, Patch
- https://github.com/uutils/coreutils/releases/tag/0.6.0Release Notes
- https://github.com/uutils/coreutils/issues/10192Exploit, Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.