Dashboard / CVE-2026-35346

CVE-2026-35346

LOW
INFO Priority: 0.01 BB Relevance: 32/100
Published: 2026-04-22 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
uutils coreutils < 0.6.0

References & Advisories (3)

https://github.com/uutils/coreutils/issues/10192
Exploit Issue Tracking Vendor Advisory

Bug Bounty Relevance

32 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

3.3 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001760
Percentile 7.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00176
2026-10-28
0.00176

Intelligence Sources

nvd ref →

External Links