CVE-2026-35346

Low

Description

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

SeverityLow

CVSS3.3

Exploit probability—

ProductUutils Coreutils

PublishedApr 22, 2026

First seenApr 22, 2026

Weakness typeCWE-176CWE-176

How to fix

Update

uutils coreutils0.6.0 or later

Patches

github.com/uutils/coreutils/pull/10206

Vendor advisories

github.com/uutils/coreutils/releases/tag/0.6.0

Affected products

Product	Affected versions	Fixed in
uutils coreutils	v < 0.6.0	0.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.