Environment Variable Handling Flaw in Uutils Coreutils

CVE-2026-35366

What is CVE-2026-35366?

The printenv utility within Uutils Coreutils exhibits a flaw where it fails to properly display environment variables that contain invalid UTF-8 byte sequences. Despite the POSIX specification allowing arbitrary bytes in environment strings, the implementation opts to silently omit these entries instead of printing them in their raw form. This behavior enables malicious actors to exploit the utility by injecting harmful environment variables, such as adversarial LD_PRELOAD values, that can evade detection from systemic inspections or administrative scrutiny. As a result, there exists the risk of library injection attacks and other threats stemming from overlooked environment configuration.

References