What’s Vulnerable › Vulnerabilities

CVE-2026-35344: uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-252

Description

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Affected products

• Uutils coreutils: all versions

References

• https://github.com/uutils/coreutils/issues/9745

Get alerted when CVE-2026-35344 or the next vulnerability affects your stack