CVE-2026-35348 PUBLISHED

uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing

Assigner: canonical
Reserved: 02.04.2026 Published: 22.04.2026 Updated: 22.04.2026

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor Uutils
Product coreutils
Versions Default: affected

Credits

  • Zellic finder

References

Problem Types

  • CWE-248: Uncaught Exception CWE

Impacts

  • CAPEC-130: Excessive Allocation