CVE-2026-35339
Uutils Coreutils ≤ 0.6.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2026-35339 is a medium-severity Incorrect Check of Function Return Value (CWE-253) vulnerability in Uutils Coreutils. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24965
Vulnerability Data
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command…
more
to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis can discover missing or incorrect return-value checks.
Documented development standards and tools can mandate verified checking of every function return value.
Security engineering principles include requirements for robust error checking of all function returns.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper error-handling and return-value checking during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect return-value checks.
Secure SDLC mandates return-value checks and error handling, directly reducing CWE-253.
Application security requirements include robust error handling that mitigates incorrect return-value checks.
Secure architecture principles require defensive coding practices such as validating function results.
Secure coding explicitly demands checking return values, covering most of CWE-253.