PT-2026-34516 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-35380

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A logic error in the cut utility causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the '-d' and '--output-delimiter' options. This can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes instead of the intended literal characters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-35380

Affected Products

Uutils Coreutils

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35380 · Security Note
• https://github.com/uutils/coreutils/releases/tag/0.8.0 · Vendor Advisory
• https://github.com/uutils/coreutils/pull/11399 · Patch
• https://twitter.com/CVEnew/status/2047012072484171912 · Twitter Post