uutils coreutils EUVD-2026-25038

The vulnerability requires all three conditions to be met simultaneously: (1) the cut utility is invoked with the -s (only-delimited) flag, (2) the -z (null-terminated) option is specified, and (3) the -d '' (empty delimiter) option is used. This is a non-default, uncommon combination; standard usage of cut employs field delimiters (e.g., -d ':' for passwd files) or operates on newline-delimited data without -z. The vulnerability affects only local users with permissions to execute the cut utility; it cannot be triggered remotely. The logic error occurs during normal execution once the flags are combined, with no additional authentication bypass or privilege escalation required beyond the ability to run cut itself.

CVSS 3.3 (AV:L/AC:L/PR:L/UI:N/S:U) indicates local attack vector with low complexity and low-privilege requirement, but limited scope and only integrity impact-no confidentiality or availability loss. SSVC assessment confirms this is not an exploitation priority: exploitation status is 'none' (no evidence of active attacks), the attack is 'not automatable' (requires deliberate invocation of the specific flag combination), and technical impact is 'partial' (data corruption rather than system compromise). However, the real-world risk varies by deployment context. For automated data processing pipelines-such as ETL workflows, log aggregation, or security information and event management (SIEM) ingestion-this creates silent data loss where malformed records bypass filtering, potentially corrupting downstream analysis or regulatory compliance logs. The low SSVC score reflects that exploitation requires intentional use of an uncommon flag combination and is limited to local/privileged contexts, making it unsuitable for remote worm-like spread. For defenders, the priority should be medium: identify if cut -s with -z and -d '' is used in any pipeline, and if so, upgrade immediately. For most general users, this is a low-priority patch unless their workflows depend on this exact combination.

An administrator or unprivileged user runs a data processing script that uses 'cut -s -z -d '' input.txt' to filter null-terminated records without delimiters from a log file or structured data source. Instead of suppressing the undelimited records, uutils cut emits all records including those without delimiters, causing downstream tools to ingest malformed or unexpected data. If the pipeline feeds a security log aggregation system, this could result in false negatives or corrupted security events being stored, degrading the visibility of security incidents.