Privilege Misinterpretation in uutils coreutils by Incorrect UID Handling
CVE-2026-35371

3.3LOW

Key Information:

Vendor

Uutils

Status
Coreutils
Vendor
CVE Published:
22 April 2026

What is CVE-2026-35371?

The id utility in uutils coreutils experiences issues in its 'pretty print' output when the real UID and effective UID are not the same. The utility mistakenly utilizes the effective GID for name lookups instead of the effective UID, leading to erroneous diagnostic information. This flaw can mislead system administrators or automated scripts, potentially resulting in mismanaged file permissions and incorrect access control decisions.

References

https://github.com/uutils/coreutils/issues/10006
issue-tracking

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zellic
.