PT-2026-34502 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-05-04 · CVE-2026-35366

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The printenv utility fails to display environment variables that contain invalid UTF-8 byte sequences. Although POSIX allows arbitrary bytes in environment strings, the implementation silently skips these entries instead of printing the raw bytes. This behavior allows malicious environment variables, such as adversarial LD PRELOAD values, to evade detection by security auditing tools or administrators, which could facilitate undetected library injection or other environment-based attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-35366

GHSA-7259-CWHX-3XX3

Affected Products

Uutils Coreutils

References · 14

• 🔥 https://github.com/uutils/coreutils/issues/9701 · Exploit
• https://github.com/uutils/coreutils/pull/9728 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.6.0 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35366 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35366 · Security Note
• https://osv.dev/vulnerability/GHSA-7259-cwhx-3xx3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35366 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35366 · Vendor Advisory
• https://github.com/uutils/coreutils/commit/0bfbbc00c7895c0fb6ea94987b4aab99e3d7ee52 · Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012087940161901 · Twitter Post
• https://t.me/cveNotify/162058 · Telegram Post