{"id":"GHSA-f2jv-wjjc-2c94","revision":"96de87449255409ba3a5eb9029d80568","records":[{"revision":"96de87449255409ba3a5eb9029d80568","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-f2jv-wjjc-2c94","aliases":["CVE-2026-35348"],"title":"uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths","description":"The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.","state":0,"publishedAt":"2026-04-22T18:31:45+00:00","modifiedAt":"2026-09-10T03:51:01.6043587+00:00","affected":[{"ecosystem":"crates.io","name":"coreutils","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.8.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-35348","https://github.com/uutils/coreutils/issues/9696","https://github.com/uutils/coreutils"],"sourceUrl":"https://github.com/advisories/GHSA-f2jv-wjjc-2c94","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f2jv-wjjc-2c94","identifiers":["GHSA-f2jv-wjjc-2c94","CVE-2026-35348"]},"retained":false,"historicalAffected":[]}],"coverage":[]}