The uutils coreutils sort utility crashes when the --files0-from option is used with filenames that are valid but not encoded in UTF-8. The implementation forces UTF‑8 parsing and uses expect(), which triggers a process panic on encountering such filenames. This divergence from GNU sort, which treats filenames as raw bytes, results in a local denial‑of‑service situation where an attacker can cause the sort program to terminate unexpectedly, disrupting automated pipelines that rely on it.

The affected product is uutils coreutils, specifically the sort command. No specific version information is provided, so any release that supports the --files0-from option may be vulnerable.

The CVSS score of 5.5 indicates a medium severity vulnerability. EPSS data is not available, and the issue is not listed in CISA KEV. The vulnerability is exploitable by a local attacker who has the ability to place files with non‑UTF‑8 names in a directory processed by sort. By triggering the crash, the attacker can disrupt services or CI/CD pipelines that depend on the sort utility.