CVE-2026-35375

OVERVIEW CVE-2026-35375 is a logic error in the split utility of uutils coreutils that causes output filename corruption when processing non-UTF-8 prefix or suffix inputs. The vulnerability stems from improper use of to_string_lossy() during chunk filename construction, which converts invalid byte sequences to UTF-8 replacement characters rather than preserving raw pathname bytes as GNU split does. This affects any system using uutils coreutils in environments with non-UTF-8 character encodings. SEVERITY The vulnerability carries a CVSS v3.1 score of 3.3 (LOW) with a local attack vector requiring low complexity and user privileges. The attack requires no user interaction and affects only the integrity of generated filenames, not confidentiality or system availability. Potential impacts include filename collisions, broken automation routines, and misdirection of output data to incorrect file destinations, though the limited scope and low severity suggest contained risk in most operational environments. EXPLOITATION STATUS This vulnerability is not actively exploited in the wild, with no public exploit code available or evidence of community weaponization. The CVE does not appear on the CISA Known Exploited Vulnerabilities list and remains inactive on threat intelligence hot lists. The extremely low EPSS score of 0.00012 indicates minimal real-world exploitation probability, suggesting this remains primarily a quality-of-conformance issue rather than an active security threat requiring immediate remediation.