CVE-2026-35348
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs co
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes.
A local attacker can exploit this to crash the utility and disrupt automated pipelines.
MEDIUM · CVSS 5.5
EPSS 0.00015
Schedule remediation
- Public exploit or PoC is available
Sigma rules0
YARA rules0