Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-35375
Analyzed
More InfoOfficial Page
Source-security@ubuntu.com
View Known Exploited Vulnerability (KEV) details
Published At-22 Apr, 2026 | 17:16
Updated At-04 May, 2026 | 19:13

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.13.3LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Type: Secondary
Version: 3.1
Base score: 3.3
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CPE Matches

uutils
uutils
>>coreutils>>Versions before 0.8.0(exclusive)
cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*
Weaknesses
CWE IDTypeSource
CWE-176Secondarysecurity@ubuntu.com
CWE ID: CWE-176
Type: Secondary
Source: security@ubuntu.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/uutils/coreutils/pull/11397security@ubuntu.com
Exploit
Issue Tracking
Patch
https://github.com/uutils/coreutils/releases/tag/0.8.0security@ubuntu.com
Release Notes
Hyperlink: https://github.com/uutils/coreutils/pull/11397
Source: security@ubuntu.com
Resource:
Exploit
Issue Tracking
Patch
Hyperlink: https://github.com/uutils/coreutils/releases/tag/0.8.0
Source: security@ubuntu.com
Resource:
Release Notes
Change History
0Changes found

Details not found