CVE-2026-35346

Summary

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

Severity

low

CVSS

3.3

EPSS

0.2% (p7)

CWE

CWE-116, CWE-176

Also known as

GHSA-6gcw-w7cp-94g9, GHSA-hwhf-8p2f-45wr

Published

2026-07-06

Updated

2026-07-06

Advisory details

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Zellic finding 3.34. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

References

• https://github.com/advisories/GHSA-6gcw-w7cp-94g9
• https://github.com/uutils/coreutils/security/advisories/GHSA-6gcw-w7cp-94g9
• https://nvd.nist.gov/vuln/detail/CVE-2026-35346
• https://github.com/uutils/coreutils/issues/10192
• https://github.com/uutils/coreutils/pull/10206
• https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946
• https://github.com/uutils/coreutils/releases/tag/0.6.0

Related advisories

• CVE-2026-35347 — medium · crates.io/uu_comm
• CVE-2026-62681 — critical · npm/orval
• CVE-2026-62682 — critical · npm/orval
• CVE-2026-72717 — critical · npm/orval
• CVE-2026-71869 — critical · npm/orval
• CVE-2026-71871 — critical · npm/orval
• CVE-2026-71865 — critical · npm/orval
• CVE-2026-71864 — critical · npm/orval

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity