A logic error in the split utility of uutils coreutils causes corruption of output filenames when non‑UTF‑8 prefixes or suffixes are supplied. The code uses to_string_lossy(), converting invalid byte sequences into the Unicode replacement character U+FFFD, which differs from GNU split that preserves raw bytes. This results in files being written with incorrect names, potentially leading to filename collisions, broken scripts, or misdirected output data.

The uutils coreutils split command is affected. No explicit affected–version information is provided; however, the vulnerability was fixed in the 0.8.0 release as indicated by the advisory links.

The CVSS score is 3.3, indicating a low severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local and that an attacker would need write access to the directory where split is executed. Exploitation would result only in data integrity problems rather than broader system compromise.