CVE-2026-35344

uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression

Published Apr 22, 2026 CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Description

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Analysis

Technical impact

The dd utility in uutils coreutils suppresses errors during file truncation by unconditionally treating the operation as successful. This behavior unintentionally hides failures on regular files and directories caused by full disks or read‑only file systems. The result is that scripts performing backups or migrations may report success while the destination file remains unchanged or contains garbage, leading to silent data corruption that can compromise backup integrity and system state.

Affected Systems

The vulnerability affects the uutils coreutils package, specifically its dd component. Version information is not disclosed, so all releases of uutils coreutils that include the current dd implementation are potentially impacted.

Risk and Exploitability

The CVSS score of 3.3 indicates low overall severity, and the EPSS score is not available. This issue is not listed in the CISA KEV catalog. The vulnerability is discovered in a local utility, so the attack vector is likely local or requires privileged execution, such as a compromised user running backup scripts.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Uutils	coreutils	affected	—

Configuration 1 [-]

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

No data.

Vendor Product Versions

Uutils

Coreutils

Version	Status	Scheme	Platform
`—`	affected	—	['linux', 'unix', 'macos']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Use an alternative dd implementation such as GNU coreutils for backup and migration tasks.
Verify the integrity of destination files after operations, for example by checking hashes or sizes.
Update to a newer version of uutils coreutils once an official patch is released, or apply a local script patch that checks for truncation errors.

Generated by OpenCVE AI on April 22, 2026 at 18:16 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-wh8p-h9hw-x2mc	uutils coreutils has an Unchecked Return Value Issue
Ubuntu USN	USN-9041-1	uutils coreutils vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.115% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/uutils/coreutils/issues/9745

History

May 4, 2026 8:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:uutils:coreutils:-:::::rust::

Apr 27, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uutils Uutils coreutils
Vendors & Products		Uutils Uutils coreutils

Apr 22, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 4:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
Title		uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
Weaknesses		CWE-252
References		https://github.com/uutils/coreutils/issues/9745
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`