CVE-2026-35380 Uutils CVE debrief

Who should care

Defenders and developers using uutils coreutils in automated scripts and data pipelines should assess exposure and verify version 0.8.0 or later is deployed. They should also review scripts for potential data corruption or logic errors and implement compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-35380 is a logic error in the cut utility of uutils coreutils that can cause silent data corruption or logic errors in automated scripts and data pipelines. Defenders and developers using uutils coreutils should assess exposure, verify version 0.8.0 or later is deployed, and review scripts for potential issues.

• Data corruption or logic errors in automated scripts and data pipelines
• Potential silent failures in data processing
• Need to verify version 0.8.0 or later is deployed
• Review of scripts for potential data corruption or logic errors required

Technical summary

The cut utility in uutils coreutils incorrectly interprets the literal two-byte string '' (two single quotes) as an empty delimiter due to a logic error. This can cause silent data corruption or logic errors in automated scripts and data pipelines. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options, leading to potential issues in data processing. Defenders and developers should assess exposure and verify version 0.8.0 or later is deployed to mitigate this vulnerability.

Defensive priority

Assess exposure in automated scripts and data pipelines using uutils coreutils, verify version 0.8.0 or later is deployed, and review scripts for potential data corruption or logic errors.

Recommended defensive actions

• Assess exposure in automated scripts and data pipelines using uutils coreutils
• Verify version 0.8.0 or later is deployed
• Review scripts for potential data corruption or logic errors
• Update coreutils to version 0.8.0 or later
• Perform a thorough review of automated scripts and data pipelines for potential issues
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions prior to 0.8.0 as vulnerable or provide explicit details on exploitation. The vulnerability was publicly disclosed on 2026-04-22T17:16:43.047Z. There are no known reports of exploitation. However, defenders should verify that version 0.8.0 or later of uutils coreutils is deployed and review scripts for potential data corruption or logic errors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.