A logic error in the env utility of uutils coreutils causes the split-string option to misinterpret backslashes. While GNU env treats backslashes within single quotes literally, uutils tries to validate these sequences and produces an "invalid sequence" error, terminating the process with exit status 125 when it encounters valid but unrecognized sequences such as \a or \x. This incompatibility disrupts automated scripts and administrative workflows that rely on standard split-string semantics, thereby creating a local denial of service for operations that invoke this option.

The affected product is the env utility within Uutils:coreutils. Any version of uutils coreutils containing the buggy env implementation is susceptible; the exact affected versions are not specified in the advisory.

The CVSS score of 3.3 indicates a low severity vulnerability. No EPSS score is available and the issue is not listed in CISA KEV, suggesting a low likelihood of widespread exploitation. The attack vector is local, requiring the attacker to execute the env command with the split-string option on an affected system. As the vulnerability only causes a process termination, its impact is limited to service disruption of the specific task using this utility and does not expose sensitive data or allow further privilege escalation.