EUVD-2026-25022
GHSA-jcjr-rh8q-7xqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft non-UTF-8 filename
-
DeliveryCreate file on filesystem
-
ExploitInvoke ln with target-directory form
-
InstallTrigger UTF-8 validation error
-
C2ln exits with failure
-
ExecuteDependent automation halts
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Unicode normalization
|
| Exploitation Conditions | Exploitation requires: (1) uutils coreutils ln utility is the system implementation (not GNU ln), (2) source filenames contain non-UTF-8 byte sequences (valid on Unix filesystems but invalid UTF-8), (3) ln is invoked with target-directory form (e.g., 'ln SOURCE... DIRECTORY' rather than 'ln SOURCE DEST'), and (4) automated scripts or system tasks expect ln to succeed with those filenames. Local user with low privileges (PR:L per CVSS) must be able to execute ln or trigger automated processes that do. Non-UTF-8 filenames are not uncommon in legacy Unix systems, NFS mounts, or filesystems with mixed encoding histories, making this condition realistic in specific operational contexts but not ubiquitous. Limitation: no remote attack vector; requires local shell access or script execution. |
| Impact | CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates local, low-complexity denial of service requiring low privileges with no user interaction. SSVC decision framework rates this as 'exploit: poc' (public exploit code exists) but 'automatable: no' (requires manual trigger or script misconfiguration) and 'technical impact: partial' (availability impact only, not confidentiality or integrity). The combination suggests moderate real-world risk in specific environments: systems relying on automated backup, deployment, or file-management scripts that process heterogeneous filename encodings are vulnerable, but attackers cannot exploit this remotely or without explicit presence in the system. The patch is vendor-released, reducing priority for proactive patching but still relevant for systems running uutils coreutils in production or containerized environments. No active exploitation in the wild is confirmed (not listed in CISA KEV); the POC status indicates security researchers have reproducible test cases but not widespread weaponization. |
| Exploit ScenarioDerived | An automated daily backup script on a legacy system contains filenames with Latin-1 encoding inherited from a previous filesystem migration. When the script runs 'ln SOURCE... /backup/links/', uutils coreutils ln rejects the source paths as invalid UTF-8 and exits with non-zero status, halting the backup process and triggering a denial of service. A local attacker or misconfigured cron job depending on this script's success could cause operational disruption or prevent legitimate backups from completing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 23, 2026
The ln utility in uutils coreutils fails to process source paths containing non-UTF-8 filename bytes when using target-directory forms, rejecting valid filenames that GNU ln handles correctly. This logic error affects automated scripts and system tasks on Unix filesystems where non-UTF-8 filenames are common, causing denial of service for those specific operations. SSVC classifies exploitation as possible (POC available) but not automatable, with partial technical impact.
RemediationAI
Upgrade uutils coreutils to the patched version released via PR #11403 (vendor confirms patch availability; consult release notes or GitHub tags for the specific patched version number). For systems unable to upgrade immediately, implement a compensating control by substituting the affected ln utility with GNU coreutils ln (install gnu-coreutils or equivalent package if available), which handles non-UTF-8 filenames correctly by design. Alternatively, audit automated scripts that invoke ln to verify they do not process filenames with non-UTF-8 bytes; if necessary, preprocess filenames to enforce UTF-8 encoding or use byte-safe alternatives (e.g., hard linking via inode numbers, or shell wrappers that escape non-UTF-8 sequences). Trade-off: GNU coreutils substitution adds a dependency but maintains POSIX compatibility; filtering non-UTF-8 filenames may silently drop valid files and mask the underlying issue. Vendors distributing uutils coreutils (including Canonical, per Reported by field) should prioritize updating packaged versions.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-176 (Improper Handling of Unicode Encoding) in uutils coreutils, a pure-Rust reimplementation of GNU coreutils. The ln utility in forms like 'ln SOURCE... DIRECTORY' enforces UTF-8 encoding validation on source filenames, whereas GNU ln and POSIX standards treat filenames as opaque byte sequences. Unix filesystems (ext4, btrfs, NFS, etc.) store filenames as arbitrary byte strings without encoding constraints; valid files with non-UTF-8 byte sequences (e.g., Latin-1, mixed encodings, or legacy filenames from system migrations) are rejected by uutils ln during the stat() call, while GNU ln succeeds. The divergence occurs because Rust's standard library and string handling default to UTF-8, and uutils did not implement locale-aware or byte-preserving filename handling equivalent to C implementations.
Know when Coreutils gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Local privilege escalation in uutils coreutils before 0.10.0: the `install` utility applies a requested setuid/setgid mo
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Exploit-DB