CVE-2026-35380

Executive Summary

CVE-2026-35380 is a logic error in the cut utility of the uutils coreutils project (a Rust-based reimplementation of GNU coreutils). The vulnerability causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character (\0) for both the -d (delimiter) and --output-delimiter options. This can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.

The vulnerability has a CVSS score of 5.5 (Medium) and a very low EPSS score (0.0%), indicating it is not currently being exploited in the wild. However, the impact is significant for environments relying on uutils for data processing, as it can cause subtle data corruption that may go undetected.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed via:

• Crates.io: uutils-coreutils crate
• Linux distributions: Some distros may package uutils as an alternative to GNU coreutils
• Container images: Docker images using uutils-based base images

The vulnerability is in the Rust source code and affects all versions prior to 0.0.29. Users should update to the latest patched version.

CVSS Breakdown & Threat Level

CVSS Score: 5.5 (Medium) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Threat Level: Medium. While exploitation requires user interaction, the silent nature of the data corruption makes it dangerous in automated pipelines.

Deep Dive & Mechanics

The vulnerability resides in the argument parsing logic of the cut utility. When a user specifies -d '' or --output-delimiter '' on the command line, the shell passes the literal two-byte string '' (two single quotes) to the program. The uutils implementation incorrectly interprets this as an empty delimiter and maps it to the NUL character (\0).

Root Cause: The argument parser treats the string '' as a special case, converting it to an empty string, which is then interpreted as NUL. This is a logic error in the delimiter handling code.

Affected Code Path:

1. User runs: cut -d '' -f1 input.txt
2. Shell passes '' as the argument to -d
3. uutils argument parser sees '' and converts it to empty string
4. Empty string is mapped to NUL character (\0)
5. cut splits input on NUL bytes instead of the literal '' string

Impact:

• Data containing '' (two single quotes) will be incorrectly split on NUL bytes
• Output delimiters will be NUL instead of ''
• Scripts expecting '' as delimiter will receive corrupted data
• Automated pipelines may produce incorrect results without error messages

Vulnerable vs. Patched Code

Vulnerable Code (v0.0.28 and earlier):

// In src/uu/cut/src/cut.rs
fn parse_delimiter(s: &str) -> Result<u8, String> {
    if s.is_empty() || s == "''" {
        // Vulnerable: treats '' as empty, maps to NUL
        Ok(0u8) // NUL character
    } else if s.len() == 1 {
        Ok(s.as_bytes()[0])
    } else {
        Err(format!("delimiter must be a single byte, got: {}", s))
    }
}

Patched Code (v0.0.29):

// In src/uu/cut/src/cut.rs
fn parse_delimiter(s: &str) -> Result<u8, String> {
    if s.is_empty() {
        // Only empty string maps to NUL
        Ok(0u8)
    } else if s.len() == 1 {
        Ok(s.as_bytes()[0])
    } else {
        // '' is now treated as a literal two-byte string
        Err(format!("delimiter must be a single byte, got: {}", s))
    }
}

The fix removes the special case for '', ensuring that only an empty string (which cannot be passed via shell) maps to NUL. The literal '' now correctly causes an error, preventing silent data corruption.

Exploitation & Lab Setup

Red Team

Exploitation Scenario: An attacker can craft a malicious input file containing '' as a delimiter and trick a user or automated script into processing it with the vulnerable cut utility.

Proof of Concept:

# Create a file with '' as delimiter
echo "field1''field2''field3" > malicious.txt

# Vulnerable cut will split on NUL instead of ''
cut -d '' -f2 malicious.txt
# Expected: field2
# Vulnerable output: (empty or corrupted, as NUL splits differently)

Automated Pipeline Attack:

# Attacker creates a data file that appears normal
echo "user:pass:role" > users.txt

# But the file actually contains '' as delimiter
# When processed by vulnerable cut, data corruption occurs
cut -d '' -f1 users.txt > output.txt
# output.txt may contain corrupted data

Blue Team

Detection:

1. Monitor for use of cut -d '' or cut --output-delimiter '' in command-line arguments
2. Check for unexpected NUL bytes in output files
3. Audit scripts that use uutils cut with delimiter options

Lab Setup:

# Install vulnerable version
cargo install uutils-coreutils --version 0.0.28

# Create test environment
mkdir /tmp/cve-test
cd /tmp/cve-test

# Test file
echo "a''b''c" > test.txt

# Verify vulnerability
cut -d '' -f2 test.txt | xxd
# Should show NUL bytes in output

# After patching, this should error

Indicators of Compromise (IOCs)

File-Based IOCs:

• Files containing unexpected NUL bytes where '' should appear
• Output files from cut with missing fields or corrupted data

Process-Based IOCs:

• Processes running cut with -d '' or --output-delimiter '' arguments
• Unusual NUL byte sequences in stdout/stderr

Network-Based IOCs:

• Data streams containing NUL bytes where '' delimiters are expected

Log-Based IOCs:

• Error messages from scripts using cut with delimiter options
• Unexpected behavior in data processing pipelines

Detection Engineering

YARA Rule

rule CVE_2026_35380_uutils_cut_delimiter {
    meta:
        description = "Detects exploitation of CVE-2026-35380 in uutils cut utility"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35380"
        severity = "medium"
    
    strings:
        $cmd1 = /cut\s+-d\s+''/ nocase
        $cmd2 = /cut\s+--output-delimiter\s+''/ nocase
        $nul_pattern = { 00 27 27 }  // NUL followed by two single quotes
    
    condition:
        any of ($cmd*) or $nul_pattern
}

Sigma Rule

title: CVE-2026-35380 - uutils cut Delimiter Logic Error
id: 8a7b9c1e-2d3f-4a5b-6c7d-8e9f0a1b2c3d
status: experimental
description: Detects exploitation attempts of CVE-2026-35380 in uutils cut utility
author: Valters IT
date: 2026-01-01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35380
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cut'
        CommandLine|contains: 
            - "-d ''"
            - "--output-delimiter ''"
    condition: selection
falsepositives:
    - Legitimate use of empty delimiter (rare)
level: medium

Suricata Rule

alert tcp any any -> any any (
    msg:"CVE-2026-35380 - uutils cut delimiter logic error exploitation";
    content:"cut -d ''";
    nocase;
    sid:1000001;
    rev:1;
    reference:cve,2026-35380;
    classtype:attempted-user;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Update uutils coreutils to version 0.0.29 or later
2. Review all scripts and pipelines using uutils cut with delimiter options
3. Validate output files for unexpected NUL bytes

Permanent Fix:

# Update via cargo
cargo install uutils-coreutils --version 0.0.29

# Or update via package manager (if available)
sudo apt update && sudo apt install uutils-coreutils

Workarounds:

• Use GNU coreutils cut instead of uutils version
• Avoid using '' as delimiter in scripts
• Add input validation to check for NUL bytes in output

Detection:

• Implement the provided YARA, Sigma, and Suricata rules
• Monitor for unexpected NUL bytes in data processing pipelines
• Audit all uses of uutils cut in production environments

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2026-35380

{/* [Security Hash: 4FA0EBA1AA071AC5BD6360AF] */}