CVE-2026-35344: uutils coreutils has an Unchecked Return Value Issue

CVE-2026-35344 · Severity: low · CVSS 3.3 · Published 2026-04-22

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Technologies: coreutils (crates.io), Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35344 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35344 being exploited in the wild.
How severe is CVE-2026-35344?
Low severity, with a CVSS score of 3.3, published 22 April 2026.
Which products and versions are affected?
coreutils (crates.io) SEMVER:introduced=0,last_affected=0.8.0.
Is there a fix for CVE-2026-35344?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-35344?
Check whether you run coreutils (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • coreutils (crates.io) SEMVER:introduced=0,last_affected=0.8.0
  • Uutils Coreutils

Identifiers

  • CVE-2026-35344
  • GHSA-wh8p-h9hw-x2mc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.