CVE-2026-35344
uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
3.3
uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
CVE-2026-35344- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-252
- Updated
- 2026-11-02
EUVDEUVD-2026-24975
3.3
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
EUVD-2026-24975- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wh8p-h9hw-x2mc
3.3
uutils coreutils has an Unchecked Return Value Issue
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
GHSA-wh8p-h9hw-x2mc- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-252
- Updated
- 2026-11-02
NVD
3.3
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
CVE-2026-35344- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-252
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-35344
3.3
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
DEBIAN-CVE-2026-35344- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-wh8p-h9hw-x2mc
3.3
uutils coreutils has an Unchecked Return Value Issue
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
GHSA-wh8p-h9hw-x2mc- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-252
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-35344
3.3
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- Record
UBUNTU-CVE-2026-35344- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
coreutilscrates.io |
through 0.8.0 | None known |
rust-coreutilsDebian:12 |
All versions, plus listed versions 0.0.17-20.0.17-30.0.17-40.0.17-50.0.17-6 Show 39 moreShow less0.0.19-10.0.19-20.0.19-30.0.20-10.0.21-10.0.22-10.0.23-10.0.23-20.0.23-30.0.24-10.0.24-20.0.26-10.0.26-20.0.26-30.0.26-40.0.26-50.0.27-10.0.27-20.0.27-30.0.30-10.0.30-20.0.30-30.0.30-3~exp10.0.30-40.10.0-10.11.0-10.11.0-20.12.0-10.6.0-10.7.0-10.8.0-10.8.0-20.8.0-30.8.0-40.8.0-50.8.0-60.9.0-10.9.0-20.9.0-3 |
None known |
rust-coreutilsDebian:13 |
All versions, plus listed versions 0.0.30-20.0.30-30.0.30-3~exp10.0.30-40.10.0-1 Show 14 moreShow less0.11.0-10.11.0-20.12.0-10.6.0-10.7.0-10.8.0-10.8.0-20.8.0-30.8.0-40.8.0-50.8.0-60.9.0-10.9.0-20.9.0-3 |
None known |
rust-coreutilsDebian:14 |
before 0.10.0-1, plus listed versions 0.0.30-20.0.30-30.0.30-3~exp10.0.30-40.6.0-1 Show 10 moreShow less0.7.0-10.8.0-10.8.0-20.8.0-30.8.0-40.8.0-50.8.0-60.9.0-10.9.0-20.9.0-3 |
0.10.0-1 |
rust-coreutilsUbuntu:24.04:LTS |
All versions, plus listed versions 0.0.20-10.0.22-10.0.23-10.0.23-20.0.23-30.0.24-10.0.24-2 |
None known |
rust-coreutilsUbuntu:25.10 |
All versions, plus listed versions 0.0.30-10.0.30-20.0.30-2ubuntu20.1.0-0ubuntu10.1.0+git20250711.2ba3a33-0ubuntu1 Show 11 moreShow less0.1.0+git20250711.2ba3a33-0ubuntu20.1.0+git20250711.2ba3a33-0ubuntu30.1.0+git20250711.2ba3a33-0ubuntu40.1.0+git20250801.cf79675-0ubuntu10.1.0+git20250813.4af2a84-0ubuntu20.1.0+git20250813.4af2a84-0ubuntu40.1.0+git20250813.4af2a84-0ubuntu60.1.0+git20250813.4af2a84-0ubuntu70.2.2-0ubuntu10.2.2-0ubuntu20.2.2-0ubuntu2.1 |
None known |
rust-coreutilsUbuntu:26.10 |
All versions, plus listed versions 0.8.0-0ubuntu30.8.0-0ubuntu40.9.0-2ubuntu20.10.0-1ubuntu10.10.0-1ubuntu2 Show 5 moreShow less0.10.0-1ubuntu30.11.0-2ubuntu10.11.0-2ubuntu20.12.0-1ubuntu10.12.0-1ubuntu2 |
None known |
rust-coreutilsUbuntu:26.04:LTS |
All versions, plus listed versions 0.2.2-0ubuntu20.2.2-0ubuntu40.5.0-0ubuntu10.5.0-0ubuntu20.6.0-0ubuntu10.7.0-0ubuntu10.8.0-0ubuntu30.10.0-1ubuntu2~26.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-35344 is a low vulnerability (CVSS 3.3) in Uutils Coreutils, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in rust-coreutils 0.10.0-1.