Executive brief
The 'comm' utility in uutils coreutils, a Rust-based implementation of standard Unix command-line tools, contains a flaw that causes silent data corruption. When comparing files that contain binary data or non-UTF-8 text encodings, the tool incorrectly converts the data, replacing unrecognized characters with a generic placeholder. This can lead to incorrect results in automated scripts or data processing pipelines that rely on the integrity of the compared files.
Technical details
The comm utility in uutils coreutils (uu_comm) was found to perform lossy UTF-8 conversion on output lines using String::from_utf8_lossy(). This implementation detail causes the utility to replace any invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD), unlike the standard GNU comm which processes raw bytes. An attacker with local access could potentially leverage this to cause silent integrity failure in data processing pipelines that handle binary or legacy-encoded files. The vulnerability was addressed by refactoring the output handling to write raw bytes directly to a locked stdout handle. The fix is available in version 0.6.0.
Affected products
- uutils uu_comm < 0.6.0
Timeline
- 2026-01-11: disclosed: Issue reported on GitHub
- 2026-01-20: patched: Fix merged into main branch
- 2026-05-30: advisory: Initial advisory published
- 2026-07-06: advisory: GitHub Advisory reviewed and updated
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-6gcw-w7cp-94g9
- https://github.com/uutils/coreutils/issues/10192
- https://github.com/uutils/coreutils/pull/10206
- https://github.com/uutils/coreutils/commit/b9372e509ea9b278fe13763237067a261bb8c946
- https://github.com/uutils/coreutils/releases/tag/0.6.0