A logic error in the ln utility of uutils coreutils causes the program to reject source paths that contain non‑UTF‑8 filename bytes when the user specifies a target directory (e.g., ln SOURCE... DIRECTORY). This failure occurs because the implementation enforces UTF‑8 encoding and does not treat filenames as raw bytes like GNU ln does. The immediate consequence is that the utility cannot stat the file, returns a non‑zero exit code, and any scripts or system tasks that depend on creating links silently fail. The vulnerability is a local denial‑of‑service condition that affects only the environment in which the ln command is executed; it does not allow remote code execution or compromise data confidentiality or integrity.

The impact is limited to installations of the uutils coreutils package, a Rust‑based reimplementation of GNU coreutils. Any Unix‑like system that uses the uutils ln utility for automated scripts, backups, or file‑management tasks is at risk, especially when those scripts process filenames containing non‑UTF‑8 bytes.

The CVSS score of 3.3 classifies this as low severity, and the EPSS score is not available, suggesting that exploitation is not widely targeted. Because the attack vector is local and requires the presence of the uutils ln utility, the risk remains limited to environments that depend on this utility. The vulnerability is not listed in CISA’s KEV catalog, and no publicly known exploits have been disclosed.