Process Panic Vulnerability in uutils Coreutils Affecting Non-UTF-8 Filenames

CVE-2026-35348

What is CVE-2026-35348?

The sort utility in uutils coreutils is subject to a process panic when the --files0-from option is employed with inputs that include non-UTF-8 filenames. Unlike GNU sort, which processes filenames as raw byte strings, the implementation in uutils coreutils enforces strict UTF-8 encoding. This leads to an immediate crash upon encountering valid but non-UTF-8 paths, enabling local attackers to disrupt the utility’s function and automate workflows.

References