CVE-2026-35381

Executive Summary

CVE-2026-35381 is a logic error in the cut utility of the uutils coreutils project, a Rust-based reimplementation of GNU coreutils. The vulnerability causes the -s (only-delimited) flag to be ignored when used in combination with the -z (null-terminated) and -d '' (empty delimiter) options. This results in the utility outputting the entire record plus a NUL byte instead of suppressing undelimited records as expected. The flaw has a CVSS score of 3.3 (Low) and primarily impacts data integrity in automated pipelines that rely on cut -s to filter out undelimited data. A patch is available in version 0.0.29.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed via package managers like cargo (Rust's package manager) and potentially as a system utility on Linux distributions. Users who have installed uutils coreutils as a drop-in replacement for GNU coreutils are at risk. The package is not distributed via PyPI, npm, or RubyGems, but its presence in the Rust ecosystem means it can be included as a dependency in Rust projects. Organizations should verify their dependency trees for any use of uutils coreutils and update to the patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 3.3 (Low)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs basic user privileges.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – Data integrity is compromised due to incorrect output.
• Availability Impact: None (A:N) – System availability is not affected.

Threat Level: Low. The vulnerability requires local access and specific command-line options to exploit. However, in automated data processing pipelines, it can lead to silent data corruption.

Deep Dive & Mechanics

The cut utility in uutils coreutils is designed to extract sections from each line of input. The -s (only-delimited) flag tells cut to suppress lines that do not contain the delimiter. The -z flag sets the line delimiter to NUL (null character), and -d '' sets the field delimiter to an empty string.

The vulnerability arises from a logic error in the implementation. When -z and -d '' are used together, the code takes a specialized code path intended for newline-delimited input. This path does not check the -s flag's record suppression status. As a result, even when -s is specified, the utility outputs the entire record followed by a NUL byte instead of suppressing it.

Root Cause: The condition that routes to the specialized newline-delimiter code path does not account for the -s flag. The fix involves adding a check for the -s flag in that code path to ensure records are suppressed when appropriate.

Vulnerable vs. Patched Code

Vulnerable Code (simplified Rust logic):

fn cut_lines(input: &str, delimiter: &str, only_delimited: bool, null_terminated: bool) {
    if null_terminated && delimiter.is_empty() {
        // Specialized code path for null-terminated with empty delimiter
        for record in input.split('\0') {
            // BUG: Does not check only_delimited flag
            println!("{}", record);
        }
    } else {
        // Normal code path
        for line in input.lines() {
            if only_delimited && !line.contains(delimiter) {
                continue;
            }
            println!("{}", line);
        }
    }
}

Patched Code (simplified Rust logic):

fn cut_lines(input: &str, delimiter: &str, only_delimited: bool, null_terminated: bool) {
    if null_terminated && delimiter.is_empty() {
        // Fixed: Check only_delimited flag
        for record in input.split('\0') {
            if only_delimited && !record.contains(delimiter) {
                continue;
            }
            println!("{}", record);
        }
    } else {
        // Normal code path
        for line in input.lines() {
            if only_delimited && !line.contains(delimiter) {
                continue;
            }
            println!("{}", line);
        }
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system with uutils coreutils version < 0.0.29.
• Ability to execute commands with the vulnerable cut utility.

Exploitation Steps:

1. Create a test file with undelimited records:

   printf "record1\0record2\0" > test.txt
   

2. Run the vulnerable cut command:

   cut -z -d '' -s -f1 test.txt
   

3. Observe that both records are output (including the NUL byte), even though -s should suppress them.

Impact: In automated pipelines, this can cause data integrity issues by including undelimited records that should have been filtered out.

Blue Team

Detection:

• Monitor for unusual usage of cut with the -z, -d '', and -s flags together.
• Check for unexpected output from cut in log files or data processing scripts.

Mitigation:

• Update uutils coreutils to version 0.0.29 or later.
• If immediate update is not possible, avoid using the combination of -z, -d '', and -s flags together.
• Implement input validation in scripts to verify the output of cut commands.

Indicators of Compromise (IOCs)

• File: Any file processed by cut -z -d '' -s that contains undelimited records.
• Process: Execution of cut with the flags -z, -d '', and -s simultaneously.
• Log Entry: Unexpected inclusion of NUL bytes in output files or streams.
• Network: Not applicable (local vulnerability).

Detection Engineering

YARA Rule

rule CVE_2026_35381_uutils_cut_logic_error {
    meta:
        description = "Detects usage of uutils cut with vulnerable flags -z, -d '', and -s"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35381"
    strings:
        $cmd1 = "cut -z -d '' -s" ascii wide nocase
        $cmd2 = "cut -z -d\"\" -s" ascii wide nocase
        $cmd3 = "cut -z -d '' -s" fullword ascii
    condition:
        any of them
}

Sigma Rule

title: Detection of uutils cut with Vulnerable Flags
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of uutils cut with the -z, -d '', and -s flags, which may indicate exploitation of CVE-2026-35381.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35381
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cut'
        CommandLine|contains|all:
            - '-z'
            - '-d '
            - '-s'
    condition: selection
falsepositives:
    - Legitimate use of cut with these flags in testing environments
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35381 uutils cut Logic Error"; content:"cut -z -d '' -s"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update uutils coreutils to version 0.0.29 or later.
2. If update is not possible, avoid using the combination of -z, -d '', and -s flags together.

Long-term Mitigations:

• Implement input validation in scripts that use cut to verify output integrity.
• Use GNU coreutils instead of uutils coreutils in production environments until the fix is widely adopted.
• Monitor for any unusual behavior in data processing pipelines.

Patch Details:

• The fix is included in uutils coreutils v0.0.29.
• The patch adds a check for the -s flag in the null-delimiter code path.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: E05E7FC1327978E8FEE19877] */}