CVE-2026-35348

OVERVIEW CVE-2026-35348 affects the sort utility in uutils coreutils, a Rust-based reimplementation of GNU core utilities. The vulnerability exists in the --files0-from option, which processes filenames from a null-delimited input. The flaw occurs because the implementation enforces UTF-8 encoding on filenames and uses expect() calls that cause an immediate process panic when encountering valid non-UTF-8 paths. This behavior diverges from GNU sort, which correctly handles filenames as raw byte sequences regardless of encoding. SEVERITY The vulnerability carries a CVSS 3.1 severity score of 5.5 (Medium) with local attack vector and low complexity requirements. An authenticated local attacker requires only user-level privileges to trigger the crash with no user interaction needed. The impact is limited to availability, causing the sort utility to panic and terminate abnormally. This can disrupt automated sorting pipelines and batch processing workflows that depend on consistent utility behavior. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. The EPSS score of 0.000130 indicates minimal probability of exploitation relative to other published CVEs. No public exploit code or proof-of-concept has been documented in community disclosures.