PT-2026-34483 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35347

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The comm utility incorrectly consumes data from non-regular file inputs before performing comparison operations. The are files identical() function opens and reads from both input paths to compare content without verifying if the paths refer to regular files. If an input path is a FIFO (a special file that allows communication between processes) or a pipe, this pre-read operation drains the stream, causing silent data loss before the actual comparison logic is executed. Furthermore, the utility may hang indefinitely when attempting to pre-read from infinite streams such as '/dev/zero'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-35347

GHSA-RX8H-33GR-VHJ9

Affected Products

Uutils Coreutils

References · 12

• 🔥 https://github.com/uutils/coreutils/pull/9545 · Exploit
• https://github.com/uutils/coreutils/releases/tag/0.6.0 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35347 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35347 · Security Note
• https://osv.dev/vulnerability/GHSA-rx8h-33gr-vhj9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35347 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35347 · Vendor Advisory
• https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e · Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012108379025883 · Twitter Post