Data Handling Flaw in Uutils Coreutils Impacting File Comparisons

CVE-2026-35347

What is CVE-2026-35347?

The comm utility in Uutils coreutils contains a flaw in its data handling procedures. It improperly processes input from non-regular file types during comparison tasks, specifically without checking if the input is a FIFO or a pipe. This oversight leads to potential data loss, as the comparison function may drain the input stream prior to executing its logic. Furthermore, when tasked with reading from infinite inputs like /dev/zero, the utility may enter an indefinite hang state, exacerbating the risk of system resource depletion and process stalls.

References