uutils coreutils CVE-2026-35377

Exploitation requires: (1) local shell access with sufficient privilege to execute commands (PR:L minimum), (2) use of the env utility with the -S (split-string) option, (3) presence of backslash escape sequences in the argument that are valid under GNU semantics but not recognized by uutils validation (e.g., \a, \x, or any backslash not followed by \ or '), and (4) scripts or workflows that depend on the result of that env command. Default configurations are not vulnerable by default because the -S option is not typically used in casual command-line invocations; vulnerability surfaces only in scripts explicitly written to use split-string mode. Non-vulnerable deployments include systems running GNU coreutils (official) or uutils coreutils with the patch applied. The impact is limited to local operations - no remote attacker can trigger this without first gaining shell access.

CVSS score of 3.3 (low) and SSVC assessment (exploitation: none, automatable: no, technical impact: partial) align with the actual threat model: this is a local-only denial of service with no authentication bypass, remote code execution, or data breach potential. The attack vector is local (AV:L) and requires low privilege (PR:L), limiting exposure to users with shell access. Automatable exploitation is 'no' because triggering this requires crafting specific scripts or commands with the -S option and vulnerable backslash sequences, which is not a default behavior. The technical impact is partial because it affects only operations using -S with certain backslash patterns; standard env usage and other command-line tools are unaffected. This is a compatibility issue rather than a security emergency - the real risk is broken workflows in organizations relying on uutils as a GNU coreutils replacement, not widespread system compromise. KEV status is not listed, POC is not noted, and exploitation in the wild is not reported, confirming this is a low-priority issue suitable for standard patch cycles rather than emergency response.

A system administrator runs an automated script that uses env -S with a split string containing valid escape sequences such as env -S 'command \a argument'. On a vulnerable uutils coreutils installation, this immediately exits with status 125 and 'invalid sequence' error, halting the entire script. If this command is part of a critical system initialization or backup workflow, the denial of service prevents the system from completing essential tasks.