{"id":"EUVD-2026-25034","enisaUuid":"ce8ee6fb-bcba-3934-ab12-80c5d46dcfd9","description":"A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.","datePublished":"Apr 22, 2026, 4:09:17 PM","dateUpdated":"Apr 22, 2026, 4:59:11 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11405\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","aliases":"CVE-2026-35379\n","assigner":"canonical","epss":0.15,"enisaIdProduct":[{"id":"35a352ca-09c0-3816-9ec8-635fc2181939","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"enisaIdVendor":[{"id":"33239ee8-4d86-3289-8053-65e581b3fe03","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"beae477d-20bb-37ac-9ed6-b58b9074318f","vulnerability":{"id":"CVE-2026-35379","description":"A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.","datePublished":"Apr 22, 2026, 4:09:17 PM","dateUpdated":"Apr 22, 2026, 4:59:11 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/11405\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25034\n","assigner":"canonical","epss":0.15,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"ccd6c38e-9676-320c-9a18-71c4f569c080","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"vulnerabilityVendor":[{"id":"94593642-1668-3929-848a-9ad38ba92e27","vendor":{"name":"Uutils"}}]}},{"id":"e8cd89d0-a542-3001-9397-d4b4254d7c63","vulnerability":{"id":"GHSA-fhr3-xh3q-69w6","description":"uutils coreutils has an Incorrect Provision of Specified Functionality Issue","datePublished":"Apr 22, 2026, 6:31:46 PM","dateUpdated":"Apr 30, 2026, 6:04:14 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35379\nhttps://github.com/uutils/coreutils/pull/11405\nhttps://github.com/uutils/coreutils/commit/358063f3367cb23a1e5db314cfdbfeb607749b3d\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25034\n","aliases":"GHSA-fhr3-xh3q-69w6\nCVE-2026-35379\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}