Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-35346

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:68c158fdc928d1c04221b7b57aa735da65ae90f5a90fc7e8b1b4ca633d4ce2a4
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"collectionURL":"https://github.com/uutils","defaultStatus":"unaffected","packageName":"coreutils","platforms":["Linux","Unix","macOS"],"product":"coreutils","repo":"https://github.com/uutils/coreutils","vendor":"Uutils","versions":[{"lessThan":"0.6.0","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-176","description":"CWE-176: Improper Handling of Unicode Encoding","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions
{"tags":["issue-tracking"],"url":"https://github.com/uutils/coreutils/issues/10192"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/cna/references/1
{"tags":["exploit"],"url":"https://github.com/uutils/coreutils/issues/10192"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/adp/0/references/0
{"tags":["patch"],"url":"https://github.com/uutils/coreutils/pull/10206"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/cna/references/0
{"tags":["vendor-advisory"],"url":"https://github.com/uutils/coreutils/releases/tag/0.6.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b1d0e8dc09d0b254a39b21682b06969942cfaea0ce438359f46d6a15aaa6dc89 · sha256:9cf3830ce2b5a41a… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer