Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7agw-m43h-pkb1
Vulnerability ID VCID-7agw-m43h-pkb1
Aliases CVE-2026-35346
GHSA-hwhf-8p2f-45wr
Summary The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.
Status Published
Exploitability 0.5
Weighted Severity 3.0
Risk 1.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-176 Improper Handling of Unicode Encoding
System Score Found at
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2026-35346
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2026-35346
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2026-35346
cvssv3.1_qr LOW https://github.com/advisories/GHSA-hwhf-8p2f-45wr
cvssv3.1 3.3 https://github.com/uutils/coreutils
generic_textual LOW https://github.com/uutils/coreutils
cvssv3.1 3.3 https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946
generic_textual LOW https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946
cvssv3.1 3.3 https://github.com/uutils/coreutils/issues/10192
generic_textual LOW https://github.com/uutils/coreutils/issues/10192
ssvc Track https://github.com/uutils/coreutils/issues/10192
cvssv3.1 3.3 https://github.com/uutils/coreutils/pull/10206
generic_textual LOW https://github.com/uutils/coreutils/pull/10206
ssvc Track https://github.com/uutils/coreutils/pull/10206
cvssv3.1 3.3 https://github.com/uutils/coreutils/releases/tag/0.6.0
generic_textual LOW https://github.com/uutils/coreutils/releases/tag/0.6.0
ssvc Track https://github.com/uutils/coreutils/releases/tag/0.6.0
cvssv3.1 3.3 https://nvd.nist.gov/vuln/detail/CVE-2026-35346
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2026-35346
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35346
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946
https://nvd.nist.gov/vuln/detail/CVE-2026-35346
0.6.0 https://github.com/uutils/coreutils/releases/tag/0.6.0
10192 https://github.com/uutils/coreutils/issues/10192
10206 https://github.com/uutils/coreutils/pull/10206
GHSA-hwhf-8p2f-45wr https://github.com/advisories/GHSA-hwhf-8p2f-45wr
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/issues/10192
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:12:18Z/ Found at https://github.com/uutils/coreutils/issues/10192
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/pull/10206
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:12:18Z/ Found at https://github.com/uutils/coreutils/pull/10206
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/uutils/coreutils/releases/tag/0.6.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:12:18Z/ Found at https://github.com/uutils/coreutils/releases/tag/0.6.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35346
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02453
EPSS Score 0.00014
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:53.457289+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35346.json 38.6.0