What’s Vulnerable › Vulnerabilities

CVE-2026-35366: uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-754

Description

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.

Affected products

• Uutils coreutils: before 0.6.0 — fixed in 0.6.0

How to fix

Upgrade to a fixed version: Uutils coreutils 0.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/uutils/coreutils/issues/9701
• https://github.com/uutils/coreutils/pull/9728
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/issues/9701

Get alerted when CVE-2026-35366 or the next vulnerability affects your stack