Data Corruption Vulnerability in uutils coreutils by uutils

CVE-2026-35346

What is CVE-2026-35346?

The comm utility in uutils coreutils has a flaw where it silently corrupts data by using lossy UTF-8 conversion on all output lines. It employs String::from_utf8_lossy(), replacing invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD), diverging from the expected behavior seen in GNU comm which correctly processes raw bytes. This can lead to data integrity issues when comparing binary files or files containing non-UTF-8 legacy encodings, ultimately resulting in incorrect or misleading output.

References