TI-2026-27511 Aliases CVE-2026-35373 GHSA-jcjr-rh8q-7xqf

uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames

MEDIUM 58CWE-176Published 2026-04-22 · Updated 2026-04-22

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00121 1st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed uu_ln (crates.io): 0.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Uutils	coreutils	—	—	No fix listed	CNA
—	uu_ln (crates.io)	before 0.6.0	0.6.0	Patch available	GHSA-jcjr-rh8q-7xqf

coreutils VendorUutils Affected — Fixed in — No fix listed CNA
uu_ln (crates.io) Vendor— Affected before 0.6.0 Fixed in 0.6.0 Patch available GHSA-jcjr-rh8q-7xqf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:uutils:coreutils:-:::::rust::	not specified by NVD	Vulnerable	Uutils

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:* Versions not specified by NVD Vulnerable ·Uutils

Remediation

Fix · GHSA-jcjr-rh8q-7xqf uu_ln (crates.io) Fixed in 0.6.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-35373
2026-10-03 Alias added: GHSA-jcjr-rh8q-7xqf

References

Exploit 1

https://github.com/uutils/coreutils/pull/11403

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-35373

Other 2

TI-2026-27506 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection CVSS 3.1HIGH 7.2
TI-2026-27498 uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition CVSS 3.1MEDIUM 6.3
TI-2026-27488 uutils coreutils cp Unexpected Privileged Executable Creation with -p CVSS 3.1MEDIUM 6.6
TI-2026-27502 uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition CVSS 3.1MEDIUM 6.3
TI-2026-27493 uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Race CVSS 3.1MEDIUM 6.3
TI-2026-27486 uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing CVSS 3.1MEDIUM 5.5

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences