Vulnerability · Published Apr 22, 2026 · Assigned by canonical
CVE-2026-35366uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement
Medium 4.4
In plain English
A medium-severity security flaw in coreutils from Uutils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35366 |
| Debian:13 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35366 |
| Debian:14 | rust-coreutils | 0.6.0-1 | DEBIAN-CVE-2026-35366 |
| Ubuntu:24.04:LTS | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35366 |
| Ubuntu:25.10 | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35366 |
Affected products (as reported)
Weakness: CWE-754 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/uutils/coreutils/issues/9701 issue-tracking
- https://github.com/uutils/coreutils/pull/9728 patch
- https://github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory