{"id":"EUVD-2026-25026","enisaUuid":"07061ac3-0ac3-3f11-9714-39abe4dae916","description":"A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.","datePublished":"Apr 22, 2026, 4:09:06 PM","dateUpdated":"Apr 22, 2026, 5:17:35 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11397\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","aliases":"CVE-2026-35375\n","assigner":"canonical","epss":0.14,"enisaIdProduct":[{"id":"f51aa3c1-1aa0-3cde-aa66-c8c8ee0484a4","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"enisaIdVendor":[{"id":"3263e88e-23b8-3269-bb34-123829ee9183","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"8648cb3a-f0d4-3569-a8f0-0bd8d2115b89","vulnerability":{"id":"CVE-2026-35375","description":"A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.","datePublished":"Apr 22, 2026, 4:09:06 PM","dateUpdated":"Apr 22, 2026, 5:17:35 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11397\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25026\n","assigner":"canonical","epss":0.14,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"c5057036-fe5e-320f-99c5-7fd6a5b436f5","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"vulnerabilityVendor":[{"id":"73696476-56c8-3050-bf09-deeaf4d08eb6","vendor":{"name":"Uutils"}}]}},{"id":"e6bb352e-3f0c-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-vx9m-xjwf-8cqm","description":"uutils coreutils has an Improper Handling of Unicode Encoding Issue","datePublished":"Apr 22, 2026, 6:31:46 PM","dateUpdated":"Apr 30, 2026, 5:56:29 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35375\nhttps://github.com/uutils/coreutils/pull/11397\nhttps://github.com/uutils/coreutils/commit/d2b9550fe821a9a10bf0cec057509211357363f1\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25026\n","aliases":"CVE-2026-35375\nGHSA-vx9m-xjwf-8cqm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}