CVE-2026-35379

uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling

Published Apr 22, 2026 CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Description

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.

Analysis

Technical impact

The tr utility in uutils coreutils contains a logic error that misclassifies the POSIX [:graph:] and [:print:] character classes by incorrectly treating the ASCII space character as graphically printable and excluding it from printable. Because of this inversion, scripts that intend to preserve whitespace or remove only visible characters may inadvertently delete all space characters, corrupting data or causing downstream processing errors.

Affected Systems

The affected product is Uutils coreutils. No specific affected version is provided in the CVE payload, so all currently available releases may be susceptible until a patch is released.

Risk and Exploitability

Based on the description, it is inferred that exploitation requires local access to the tr command and there is no remote or privilege‑escalation vector. The CVSS score of 3.3 indicates low severity. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation likelihood under current conditions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Uutils

coreutils

unaffected

Version	Status	Constraints
`0`	affected	< 0.8.0

Configuration 1 [-]

cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*

No data.

Vendor Product Versions

Uutils

Coreutils

Version	Status	Scheme	Platform
`[0,0.8.0)`	affected	semver	['linux', 'unix', 'macos']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check with the Uutils coreutils maintainers or community for an official patch or update that addresses the character class handling issue.
Avoid using tr with the [:graph:] or [:print:] classes in scripts that depend on POSIX semantics until a verified fix is available.
Validate tr output in automated workflows to detect unexpected removal of whitespace and mitigate potential data corruption.

Generated by OpenCVE AI on April 28, 2026 at 15:19 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-fhr3-xh3q-69w6	uutils coreutils has an Incorrect Provision of Specified Functionality Issue

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.149% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/uutils/coreutils/pull/11405
https://github.com/uutils/coreutils/releases/tag/0.8.0

History

Apr 29, 2026 4:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:uutils:coreutils::::::rust::*

Apr 27, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uutils Uutils coreutils
Vendors & Products		Uutils Uutils coreutils

Apr 22, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 4:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.
Title		uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling
Weaknesses		CWE-684
References		https://github.com/uutils/coreutils/pull/11405 https://github.com/uutils/coreutils/releases/tag/0.8.0
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`