CVE-2026-35346 PUBLISHED

uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization

Assigner: canonical
Reserved: 02.04.2026 Published: 22.04.2026 Updated: 22.04.2026

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 3.3

Product Status

Vendor Uutils
Product coreutils
Versions Default: unaffected
  • affected from 0 to 0.6.0 (excl.)

Credits

  • Zellic finder

References

Problem Types

  • CWE-176: Improper Handling of Unicode Encoding CWE

Impacts

  • CAPEC-184: Software Integrity Attack