CVE-2026-35378

CVE-2026-35378 is a logic error in the expr utility of uutils coreutils where parenthesized subexpressions are evaluated during parsing rather than execution, breaking proper short-circuiting for logical OR and AND operations. This flaw causes the utility to raise arithmetic errors from "dead" branches that should be ignored, causing shell scripts relying on GNU expr compatibility to terminate prematurely instead of returning expected boolean results. The vulnerability affects systems using uutils coreutils where expr is deployed in conditional expressions within shell scripts. The vulnerability has a CVSS score of 3.3 (LOW) with a local attack vector requiring low complexity and low privileges. The impact is limited to availability, with no confidentiality or integrity effects. The EPSS score of 0.00014 indicates this is among the rarest CVEs in terms of predicted exploit likelihood, well below the average baseline. There is no evidence of active exploitation, and the vulnerability is not listed on the Known Exploited Vulnerabilities catalog. The FAUCET risk score of 27.0/100 reflects minimal community attention or documented exploit code availability. Organizations using uutils coreutils should monitor for patches, though the immediate threat level remains low.