uutils coreutils CVE-2026-35348

The --files0-from option must be explicitly used with sort, and the input file list must contain at least one filename with invalid UTF-8 byte sequences. Non-UTF-8 filenames are valid on Unix filesystems (where filenames are byte strings, not Unicode strings) and can occur legitimately from imports, legacy systems, or corrupted filesystem metadata. No special configuration is required beyond invoking sort with this flag; any local user with read access to a file containing such a list can trigger the crash. The vulnerability does NOT occur with default sort usage or with UTF-8-clean filenames.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U) reflects local authenticated access with low complexity and high availability impact. SSVC decision framework data (Exploitation: poc, Automatable: no, Technical Impact: partial) provides additional context: a proof-of-concept exists but the attack is not automatable, suggesting it requires deliberate crafting of non-UTF-8 filenames and invocation of sort with --files0-from, and the impact is partial (disruption of a single process rather than system-wide compromise). The combination of low CVSS, non-automatable exploitation, and partial technical impact suggests this is a moderate real-world priority: an attacker with local access could disrupt automated sorting pipelines or batch processing systems, but widespread exploitation is unlikely without deliberate targeting. The requirement for PR:L (low privileges) is notable-any local user can trigger this, increasing risk in multi-tenant or shared systems. However, the need to craft specific non-UTF-8 input and knowledge of the --files0-from flag limits opportunistic exploitation. This is NOT a high-severity issue but IS a reliability concern for systems relying on uutils coreutils in production pipelines.

A system administrator runs an automated backup script that uses uutils sort --files0-from /tmp/file_list to process a list of files. An attacker with local access crafts a file_list containing a null-separated entry with an invalid UTF-8 sequence (e.g., raw bytes 0xFF 0xFE in a filename). When the script invokes sort, the process panics immediately, causing the backup pipeline to fail and alerting operators to a potential breach or malfunction, disrupting availability.