CVE-2026-35346CWE-176

uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization

Low · published April 22, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-176 · Improper Handling of Unicode Encoding
Published
2026-04-22T16:07Z
EPSS history
Timeline
  • 22 APR 16:07Z
    uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization
    cvelistv5