Uutils coreutils up to 0.7.x incorrect short circuit evaluation

Summaryinfo

A vulnerability classified as problematic has been found in Uutils coreutils up to 0.7.x. This affects an unknown part. This manipulation causes incorrect short circuit evaluation. This vulnerability is tracked as CVE-2026-35378. The attack is restricted to local execution. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Uutils coreutils up to 0.7.x and classified as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a incorrect short circuit evaluation vulnerability. The CWE definition for the vulnerability is CWE-768. The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring. As an impact it is known to affect availability. The summary by CVE is:

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR (|) and AND (&) operations. As a result, arithmetic errors (such as division by zero) occurring within "dead" branches, branches that should be ignored due to short-circuiting, are raised as fatal errors. This divergence from GNU expr behavior can cause guarded expressions within shell scripts to fail with hard errors instead of returning expected boolean results, leading to premature script termination and breaking GNU-compatible shell control flow.

The weakness was disclosed by Zellic. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-35378 since 04/02/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.8.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25032). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Uutils

Name

• coreutils

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7

Website

• Product: https://github.com/uutils/coreutils/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion