CVE-2026-35348

What it actually does

The affected uutils coreutils implementation of sort mishandles the --files0-from option when the referenced input list contains valid filesystem paths that are not encoded as UTF-8. Instead of treating filenames as raw bytes, the utility enforces UTF-8 conversion and reaches an expect() panic path, causing the sort process to terminate immediately. The flaw does not provide code execution, privilege escalation, data disclosure, or data modification by itself, but it can reliably disrupt scripts, batch jobs, build systems, backup routines, data-processing pipelines, or other automation that depends on sort completing successfully.

Why it matters to the business

Organizations using uutils coreutils in automation can experience failed jobs, interrupted data processing, incomplete operational workflows, or cascading failures in pipelines that assume sort behaves like GNU coreutils. The issue requires local ability to influence filenames or the file list consumed by --files0-from, so broad internet-scale exploitation is unlikely; however, the availability impact can be significant in shared development, CI/CD, data-processing, or multi-user environments where untrusted users can create files consumed by privileged or scheduled automation. EPSS is very low and stable, it is not listed in CISA KEV, and there is no known ransomware usage, so remediation should be prioritized based on operational dependency rather than active mass exploitation.

How an attack unfolds

An attacker with local access or the ability to place files in a directory processed by automation creates one or more filenames containing byte sequences that are valid on the filesystem but invalid UTF-8. The attacker then waits for, or triggers, a script or scheduled job that invokes uutils sort with --files0-from against a NUL-delimited file list containing those filenames. When sort reads the list, the implementation attempts to interpret the filename as UTF-8 and reaches an internal expect() failure. The sort process panics and exits instead of sorting input, causing the calling script or pipeline stage to fail. If downstream automation lacks error handling, this may halt larger workflows, prevent reports or artifacts from being generated, delay deployments, or interrupt recurring operational tasks.

How to fix it

Upgrade uutils coreutils to a version that fixes the --files0-from non-UTF-8 filename panic once a fixed release is available from the project or the operating-system/package maintainer. No fixed version was provided in the supplied advisory data, so track upstream uutils coreutils security releases and downstream distribution advisories. Where immediate upgrade is not possible, prefer GNU coreutils sort for workflows that must process arbitrary filesystem names as raw bytes. As a mitigation, avoid using uutils sort --files0-from on file lists influenced by untrusted users; validate or sanitize filename inputs before generating the NUL-delimited list; isolate user-writable directories from privileged automation; and ensure scripts treat sort failures as controlled errors rather than allowing unexpected cascading failures.

How to confirm the fix worked

Confirm which sort implementation is being used by checking the package provenance and binary version in affected images, hosts, and build environments. Validate remediation by running a regression test that creates a filename containing invalid UTF-8 bytes, includes it in a NUL-delimited list, and invokes sort --files0-from against that list; a fixed or unaffected implementation should not panic. Review automation that depends on sort --files0-from and confirm it either uses a patched uutils coreutils release, uses GNU coreutils sort, or rejects untrusted non-UTF-8 filenames before invocation. Also verify monitoring alerts on unexpected nonzero exits or panic output from sort in critical pipelines.

Typical attack path

1. Gain local access to a system, build runner, shared workspace, or application-controlled directory where filenames can be created or influenced.
2. Create a file or path whose name contains non-UTF-8 byte sequences that are accepted by the underlying filesystem.
3. Ensure the malformed path is included in a NUL-delimited file list used with sort --files0-from, or cause automation to generate such a list.
4. Trigger or wait for a script, scheduled task, CI job, data-processing job, or maintenance routine that invokes uutils sort with --files0-from.
5. The sort process panics when it encounters the non-UTF-8 filename and terminates unexpectedly.
6. The dependent automation fails, potentially causing service delays, incomplete processing, or operational disruption.

How to detect it

Look for evidence of unexpected sort process termination, Rust panic output, or job failures around workflows that call sort --files0-from. Relevant sources include CI/CD job logs, cron or systemd timer logs, shell script logs, application worker logs, container stdout/stderr, endpoint process execution telemetry, and package/runtime crash logs. Focus on commands invoking sort with --files0-from, followed by panic messages, nonzero exits, aborted pipeline stages, or repeated failures after processing user-writable directories. If process command-line logging is available, search for sort executions that include --files0-from and correlate them with stderr messages containing Rust panic strings or invalid UTF-8 conversion failures. For forensic review, inspect recently created filenames in user-writable or automation-input directories for non-UTF-8 byte sequences and compare creation times with failed sort jobs. Because there are no known public exploit campaigns, ransomware usage, or named threat actors for this issue, detection should focus on local misuse, accidental triggering, and operational disruption patterns rather than network indicators.

• sort --files0-from
• --files0-from
• thread 'main' panicked
• panicked at
• called `Result::unwrap()`
• called `Option::unwrap()`
• invalid utf-8
• invalid UTF-8
• stream did not contain valid UTF-8
• OsString
• uutils
• coreutils sort

What your security team should do

• Inventory systems, containers, build images, and scripts that use uutils coreutils, especially where sort is invoked with --files0-from.
• Prioritize review of CI/CD runners, shared development systems, data-processing pipelines, backup jobs, and scheduled automation that process user-controlled or externally supplied filenames.
• Replace uutils sort with GNU coreutils sort for high-criticality workflows until a patched uutils coreutils version is available and deployed.
• Add input validation or isolation controls so untrusted users cannot introduce arbitrary filenames into file lists consumed by privileged automation.
• Add defensive error handling to scripts so a failed sort command does not cause uncontrolled downstream failures or partial processing.
• Monitor upstream and distribution advisories for a fixed uutils coreutils release, then update affected packages and base images.
• Search recent job logs and system logs for Rust panic output or failed sort --files0-from executions to identify prior disruption attempts or accidental triggers.