CVE-2026-35344
Uutils Coreutils
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2026-35344 is a low-severity Unchecked Return Value (CWE-252) vulnerability in Uutils Coreutils. Its CVSS base score is 3.3 (Low).
Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24975
Vulnerability Data
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and…
more
directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires patching the unchecked Result::ok() flaw in uutils dd to eliminate silent truncation failures.
Requires integrity verification of files written by dd, detecting the silent corruption on full disks or read-only filesystems.
Mandates proper error detection and handling for operations such as file truncation, preventing suppression of failures.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect missing return-value checks.
Secure development life cycle mandates verification of return values to prevent undetected failures.
Application security requirements include input/output validation and error handling that covers return-value checks.
Secure system architecture and engineering principles require robust error handling and defensive coding practices.
Secure coding explicitly requires checking return values to avoid CWE-252.