CVE-2026-35378
Uutils Coreutils ≤ 0.8.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-35378 is a low-severity Incorrect Short Circuit Evaluation (CWE-768) vulnerability in Uutils Coreutils. Its CVSS base score is 3.3 (Low).
Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and CM-7 (Least Functionality) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25032
Vulnerability Data
A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR…
more
(|) and AND (&) operations. As a result, arithmetic errors (such as division by zero) occurring within "dead" branches, branches that should be ignored due to short-circuiting, are raised as fatal errors. This divergence from GNU expr behavior can cause guarded expressions within shell scripts to fail with hard errors instead of returning expected boolean results, leading to premature script termination and breaking GNU-compatible shell control flow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching or replacement of the flawed uutils expr implementation to restore correct short-circuit evaluation semantics.
Allows disabling or restricting the non-compliant expr binary so that only GNU-compatible implementations are permitted in the execution environment.
Enables monitoring of expr process failures and arithmetic exceptions that result from the missing short-circuit behavior in scripts.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent flawed conditional logic via reviews and static analysis, but this CWE addresses only one narrow coding defect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect short-circuit behavior before release.
Secure SDLC practices can include code-review rules that catch short-circuit side-effect bugs.
Application security requirements can mandate safe evaluation order and side-effect-free conditions.
Secure architecture principles discourage reliance on side effects inside conditional expressions.
Secure-coding standards directly forbid short-circuit side effects and require explicit evaluation order.