Logic Error in uutils Coreutils Creates Filename Corruption

CVE-2026-35375

What is CVE-2026-35375?

A logic error in the split utility of uutils coreutils can result in filename corruption when processing non-UTF-8 prefix or suffix inputs. The method employed for creating chunk filenames rewrites invalid byte sequences using the to_string_lossy() function, leading to filenames that may not accurately reflect the intended output. This divergence from GNU split, which retains raw pathname bytes, can lead to potential filename collisions, disrupt automated processes, and misdirect output data in environments with non-UTF-8 encodings. Users are advised to be cautious and monitor their file outputs under these circumstances.

References