CVE-2026-35375

Executive Summary

CVE-2026-35375 describes a logic error in the split utility of the uutils coreutils project. The vulnerability arises when the utility is provided with non-UTF-8 prefix or suffix inputs. The implementation uses to_string_lossy() when constructing chunk filenames, which automatically replaces invalid byte sequences with the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments using non-UTF-8 encodings, this leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or misdirection of output data.

The vulnerability has a CVSS score of 3.3 (Low), indicating a low severity due to the requirement for local access and user interaction. The EPSS score is 0.0%, suggesting a very low probability of exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers like cargo (Rust's package manager) and potentially through Linux distribution repositories. Users who rely on uutils as a drop-in replacement for GNU coreutils in environments with non-UTF-8 locales are at risk. The supply chain risk is moderate, as the vulnerability could be introduced into automated scripts and data pipelines that depend on predictable filename generation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.3 (Low)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: Required (UI:R) – The user must run the split command with crafted non-UTF-8 inputs.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Output filenames are corrupted, potentially causing data misdirection.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. Exploitation requires local access and user interaction. The primary risk is data integrity in automated pipelines using non-UTF-8 locales.

Deep Dive & Mechanics

The split utility in uutils coreutils divides a file into smaller chunks, generating output filenames based on a user-provided prefix and suffix. The vulnerability lies in the filename construction logic:

1. Normal Behavior: When splitting a file, split creates output files like prefixaasuffix, prefixabsuffix, etc., where aa, ab, etc., are incremental suffixes.

2. The Bug: The implementation uses Rust's to_string_lossy() method to convert the prefix and suffix from byte sequences to strings. This method replaces any invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD, encoded as \xEF\xBF\xBD in UTF-8).

3. Impact: If a user provides a prefix or suffix containing non-UTF-8 bytes (e.g., in Latin-1 or Shift-JIS encoded environments), those bytes are silently replaced. For example:

   • Input prefix: \xFF\xFE (invalid UTF-8)
   • Expected filename: \xFF\xFEaa
   • Actual filename: \xEF\xBF\xBD\xEF\xBF\xBDaa (two replacement characters)

4. Divergence from GNU split: GNU split preserves the raw bytes of the prefix/suffix, allowing filenames with arbitrary byte sequences. This behavior is critical in environments where filenames are encoded in non-UTF-8 character sets.

5. Consequences:

   • Filename Collisions: Different non-UTF-8 inputs may map to the same replacement character sequence, causing files to overwrite each other.
   • Broken Automation: Scripts expecting specific filenames will fail.
   • Data Misdirection: Output data may be written to unintended files.

Vulnerable vs. Patched Code

Vulnerable Code (uutils split):

// Hypothetical vulnerable implementation
fn generate_filename(prefix: &[u8], suffix: &[u8], chunk_id: &str) -> String {
    let prefix_str = String::from_utf8_lossy(prefix).to_string();
    let suffix_str = String::from_utf8_lossy(suffix).to_string();
    format!("{}{}{}", prefix_str, chunk_id, suffix_str)
}

Patched Code (Expected fix):

// Patched implementation preserving raw bytes
fn generate_filename(prefix: &[u8], suffix: &[u8], chunk_id: &str) -> Vec<u8> {
    let mut filename = Vec::new();
    filename.extend_from_slice(prefix);
    filename.extend_from_slice(chunk_id.as_bytes());
    filename.extend_from_slice(suffix);
    filename
}

The fix involves using raw byte vectors instead of converting to strings, ensuring that non-UTF-8 bytes are preserved in the output filenames.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system with uutils coreutils installed.
• Ability to create files with non-UTF-8 names or provide non-UTF-8 arguments.

Exploitation Steps:

1. Identify vulnerable version:

   split --version | grep uutils
   

2. Create a test file:

   echo "This is a test file" > input.txt
   

3. Craft non-UTF-8 prefix:

   # Create a prefix with byte 0xFF (invalid UTF-8)
   prefix=$(printf '\xff')
   split --prefix="$prefix" input.txt
   

4. Observe corrupted filenames:

   ls -la
   # Expected: \xffaa, \xffab, etc.
   # Actual: \xef\xbf\xbdaa, \xef\xbf\xbdab, etc.
   

5. Exploit for filename collision:

   • Create two different non-UTF-8 prefixes that both map to the same replacement character sequence.
   • Run split with both prefixes on different files.
   • Observe that output files overwrite each other.

No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

1. Monitor for split commands with non-ASCII or non-UTF-8 arguments.
2. Check for filenames containing the UTF-8 replacement character (U+FFFD) in directories where split is used.
3. Audit logs for unexpected file creation patterns.

Defense:

1. Upgrade: Update uutils coreutils to a patched version when available.
2. Workaround: Use GNU coreutils instead of uutils in environments with non-UTF-8 locales.
3. Input Validation: Sanitize prefix/suffix inputs to ensure they are valid UTF-8 if using uutils.
4. Monitoring: Implement file integrity monitoring to detect unexpected filename changes.

Indicators of Compromise (IOCs)

• File Names: Files containing the UTF-8 replacement character (U+FFFD, hex: EF BF BD) in their names, especially in directories where split is used.
• Process Anomalies: Execution of split with non-ASCII or non-UTF-8 arguments.
• Log Entries: System logs showing split commands with unusual prefix/suffix values.
• File System Changes: Unexpected creation of files with names containing \xEF\xBF\xBD sequences.

Detection Engineering

YARA Rule

rule CVE_2026_35375_uutils_split_filename_corruption {
    meta:
        description = "Detects filenames containing UTF-8 replacement character (U+FFFD) indicative of CVE-2026-35375 exploitation"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-35375"
        severity = "low"
    strings:
        $replacement_char = { EF BF BD }
    condition:
        $replacement_char at 0 or $replacement_char in (0..255)
}

Sigma Rule

title: Detection of uutils split with Non-UTF-8 Arguments
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of uutils split with non-UTF-8 prefix or suffix arguments
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/split'
        CommandLine|contains: 
            - '\x00'
            - '\xff'
            - '\xfe'
    condition: selection
falsepositives:
    - Legitimate use of binary data in filenames
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35375 uutils split filename corruption"; flow:to_server; content:"split"; nocase; pcre:"/split\s+.*[\x80-\xFF]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Identify affected systems: Check for uutils coreutils installations.
2. Workaround: Replace uutils with GNU coreutils in environments using non-UTF-8 locales.
3. Input sanitization: Ensure all prefix/suffix inputs to split are valid UTF-8.

Long-term Fix:

• Apply the official patch from the uutils project when released.
• The fix should replace to_string_lossy() with raw byte handling in filename construction.

Monitoring:

• Implement file integrity monitoring to detect filenames with replacement characters.
• Audit logs for unusual split command usage.

Valters IT Signature:

This report was generated by Valters IT DevSecOps AI Assistant. For questions or further analysis, contact your Valters IT representative.

{/* [Security Hash: FC8E8C0781E385124715E4CB] */}