Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-x173-jyfw-1ued
Vulnerability ID VCID-x173-jyfw-1ued
Aliases CVE-2026-35347
GHSA-rx8h-33gr-vhj9
Summary The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2026-35347
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2026-35347
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2026-35347
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2026-35347
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rx8h-33gr-vhj9
cvssv3.1 4.4 https://github.com/uutils/coreutils
generic_textual MODERATE https://github.com/uutils/coreutils
cvssv3.1 4.4 https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e
generic_textual MODERATE https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e
cvssv3.1 4.4 https://github.com/uutils/coreutils/pull/9545
generic_textual MODERATE https://github.com/uutils/coreutils/pull/9545
ssvc Track https://github.com/uutils/coreutils/pull/9545
cvssv3.1 4.4 https://github.com/uutils/coreutils/releases/tag/0.6.0
generic_textual MODERATE https://github.com/uutils/coreutils/releases/tag/0.6.0
ssvc Track https://github.com/uutils/coreutils/releases/tag/0.6.0
cvssv3.1 4.4 https://nvd.nist.gov/vuln/detail/CVE-2026-35347
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-35347
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35347
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e
https://nvd.nist.gov/vuln/detail/CVE-2026-35347
0.6.0 https://github.com/uutils/coreutils/releases/tag/0.6.0
9545 https://github.com/uutils/coreutils/pull/9545
GHSA-rx8h-33gr-vhj9 https://github.com/advisories/GHSA-rx8h-33gr-vhj9
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/uutils/coreutils
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/uutils/coreutils/pull/9545
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:11:26Z/ Found at https://github.com/uutils/coreutils/pull/9545
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/uutils/coreutils/releases/tag/0.6.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:11:26Z/ Found at https://github.com/uutils/coreutils/releases/tag/0.6.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35347
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06879
EPSS Score 0.00023
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:56.071006+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35347.json 38.6.0