CVE-2026-35373

CVE-2026-35373 is a logic error in the ln (link) utility of uutils coreutils that improperly rejects source paths containing non-UTF-8 filename bytes when using target-directory forms. Unlike GNU ln, which treats filenames as raw bytes and processes them correctly, uutils enforces UTF-8 encoding validation, causing the utility to fail with non-zero exit codes when encountering valid but non-UTF-8 filenames common on Unix filesystems. This affects automated scripts and system tasks that work with such files, creating a local denial of service condition. The vulnerability carries a CVSS score of 3.3 (Low) with a local attack vector requiring low complexity and low privileges but no user interaction. The impact is limited to availability, affecting specific file operations without compromising confidentiality or integrity. The EPSS score of 0.00013 indicates this is not a widespread threat relative to other CVEs. There is no indication of active exploitation, no entry on the Known Exploited Vulnerabilities (KEV) catalog, and the vulnerability remains inactive on security hot lists. This suggests minimal community attention and no publicly available proof-of-concept exploits at this time. The low severity rating and limited practical exploitation potential reflect its status as primarily an operational compatibility issue rather than a security emergency.