uutils coreutils CVE-2026-35371

The vulnerability is triggered specifically when: (1) the real UID and effective UID of a process differ (a condition created by setuid binaries, sudo elevation, or capability-based privilege escalation), AND (2) the pretty-print output mode is used (the default human-readable id output format, not raw numeric or JSON output if those options exist). Exploitation requires local access to the system and the ability to execute id on a process with differing real and effective UIDs (privilege level PR:L per CVSS vector). Non-setuid processes with matching real and effective UIDs will not trigger the bug. The misleading output does not require any special network access or user interaction beyond running the id command, but the downstream impact (incorrect access control decisions) depends entirely on whether the output is consumed by automated tools or acted upon by administrators.

CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates low-severity information disclosure with local-only access, low attack complexity, and requirement for low privileges. SSVC framework confirms limited real-world risk: exploitation requires proof-of-concept code (not automated weaponization), technical impact is partial (information disclosure only, no confidentiality breach or integrity compromise of critical assets), and automation is not feasible (human interpretation of output is required). The combination of CVSS and SSVC signals suggests this is a correctness/diagnostic bug rather than a security-critical vulnerability. However, the actual risk depends on whether automated systems parse id output for security decisions-if configuration management tools or access control scripts rely on id output parsing, the misleading information could cascade into real security decisions. No evidence of widespread automated parsing in critical security contexts is apparent from available data, placing this as a low-priority but non-zero information integrity issue. No KEV status or active exploitation reported, further reducing practical risk.

A system administrator runs id on a process with elevated effective UID but lower real UID (e.g., a setuid binary or sudo-spawned process). The output incorrectly displays a group name instead of a user name for the effective UID field. An automated access control audit script parses the id output to verify that setuid binaries are owned by expected users; it fails to recognize the group name as invalid and incorrectly approves the process as authorized, or conversely incorrectly flags it as a security violation.