CVE catalog

CVE-2026-35366

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implemen

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-coreutilssid0.12.0-1fixed
Debianrust-coreutilsforky0.12.0-1fixed
Debianrust-coreutilstrixie0.0.30-2vulnerable
Debianrust-coreutilsbookworm0.0.17-2vulnerable
Cperust-coreutilsNot reportedNot reportedvulnerable
CpecoreutilsNot reported0.6.0fixed
Ubunturust-coreutils24.040.0.20-1vulnerable
Ubunturust-coreutils24.040.0.22-1vulnerable
Ubunturust-coreutils24.040.0.23-1vulnerable
Ubunturust-coreutils24.040.0.23-2vulnerable
Ubunturust-coreutils24.040.0.23-3vulnerable
Ubunturust-coreutils24.040.0.24-1vulnerable
Ubunturust-coreutils24.040.0.24-2vulnerable
Ubunturust-coreutils25.100.0.30-1vulnerable
Ubunturust-coreutils25.100.0.30-2vulnerable
Ubunturust-coreutils25.100.0.30-2ubuntu2vulnerable
Ubunturust-coreutils25.100.1.0-0ubuntu1vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu1vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu2vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu3vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu4vulnerable
Ubunturust-coreutils25.100.1.0+git20250801.cf79675-0ubuntu1vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu2vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu4vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu6vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu7vulnerable
Ubunturust-coreutils25.100.2.2-0ubuntu1vulnerable
Ubunturust-coreutils25.100.2.2-0ubuntu2vulnerable
Ubunturust-coreutils25.100.2.2-0ubuntu2.1vulnerable
CpecoreutilsNot reported0.6.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-coreutilssourcesid0.6.0-1not yet assignedNot reportedNot reported
Debianrust-coreutilssourceforky0.6.0-1not yet assignedNot reportedNot reported
Debianrust-coreutilssourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianrust-coreutilssourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpecoreutilscpeNot reported0.6.0Not reportedNot reportedNot reported
CpecoreutilscpeNot reported0.6.0Not reportedNVD-CVE-2026-35366Not reported

Notes

[trixie] rust-coreutils: Minor issue [bookworm] rust-coreutils: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.17-2 · amd64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

    • 0.0.17-2 · arm64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

[Debian 13 (Trixie)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.30-2 · amd64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

    • 0.0.30-2 · arm64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]