uutils coreutils CVE-2026-35366

Exploitation requires the following specific conditions: (1) the target system must be running uutils coreutils printenv utility version before 0.6.0, not the standard GNU coreutils or other printenv implementations; (2) the attacker must have local user-level access to the target system (unprivileged account, PR:L from CVSS); (3) the attacker must be able to inject or set environment variables in a context where a subsequent process or administrator invokes printenv to inspect them (such as in a user shell session or through cron/systemd user services); (4) the malicious environment variable must contain at least one byte sequence that is invalid UTF-8 to trigger the evasion; and (5) the administrator or security tool must rely exclusively on printenv output for environment auditing without supplementary inspection methods. Systems using GNU coreutils (the standard implementation on most Linux distributions) are NOT affected by this vulnerability. Environments using alternative environment inspection methods (procfs, strace, kernel audit frameworks) are not vulnerable to detection evasion even if uutils coreutils is installed, because those methods retrieve raw bytes without UTF-8 filtering.

The CVSS score of 4.4 with AV:L/AC:L/PR:L indicates localized attack surface requiring unprivileged user execution with low complexity. SSVC data confirms proof-of-concept availability (Exploitation: poc) but marks the attack as non-automatable (Automatable: no), with only partial technical impact. This scoring profile suggests the vulnerability is primarily a detection evasion mechanism rather than a high-severity code execution vector. Real-world risk depends on deployment context: the threat is significant only when an attacker already has local system access and can inject malicious LD_PRELOAD or similar variables, and when administrators depend on printenv output for security auditing. The non-automatable classification implies that exploitation requires deliberate, targeted setup rather than widespread scripted attacks. The absence of KEV (CISA Known Exploited Vulnerabilities) listing despite POC availability suggests limited real-world exploitation to date. For most organizations running uutils coreutils, the risk is moderate and tied to the degree of reliance on printenv for environment monitoring - infrastructure already using other inspection methods (strace, procfs, etc.) would see minimal incremental risk from this specific gap.

An unprivileged local user crafts a malicious environment variable containing invalid UTF-8 sequences in a strategic variable name like LD_PRELOAD, embedding an encoded reference to a compromised shared library. The user launches a privileged application in their session or via a privilege-escalation vector. When administrators run printenv to audit the environment for suspicious injection, the malicious LD_PRELOAD entry is silently omitted from the output due to the UTF-8 decoding failure, allowing the injection to evade detection. The library is then loaded into the privileged process, enabling code execution within that privilege context. Proof-of-concept code demonstrating this evasion is available at https://github.com/uutils/coreutils/issues/9701.