CVE-2026-35366

Katalog CVE

CVSS 4.4 · Medium EPSS 0,19%

Kerentanan Improper Check for Unusual or Exceptional Conditions pada uutils coreutils. Skor CVSS 3.1 4.4 (Medium) menurut ubuntu.com.

Deskripsi (NVD)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber ubuntu.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/uutils/coreutils/pull/9728 issue tracking · patch
• https://github.com/uutils/coreutils/issues/9701 exploit · issue tracking
• https://github.com/uutils/coreutils/releases/tag/0.6.0 release notes