Executive brief
The 'comm' utility in the Rust-based uutils coreutils package, which is used to compare files line-by-line, contains a flaw that causes silent data corruption. When processing files that contain non-standard text encodings or binary data, the utility incorrectly converts the data to UTF-8, replacing original characters with generic replacement symbols. This can lead to incorrect comparison results and corrupted output files in automated workflows or data processing pipelines.
Technical details
The 'comm' utility in uutils coreutils (the Rust implementation of GNU coreutils) improperly handles non-UTF-8 input data. The implementation utilized Rust's 'String::from_utf8_lossy()' function, which automatically replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior deviates from the standard GNU 'comm' utility, which processes raw bytes and preserves the original input integrity. An attacker or a malformed file can cause the utility to produce corrupted output when comparing binary files or files using legacy encodings. The issue was resolved in version 0.6.0 by refactoring the utility to write directly to a locked stdout handle using 'write_all', bypassing lossy string conversions.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2026-01-11: disclosed: Issue reported on GitHub repository
- 2026-01-20: patched: Fix merged into main branch
- 2026-02-02: advisory: Version 0.6.0 released with the fix
- 2026-04-22: advisory: CVE-2026-35346 published
- 2026-07-06: other: Duplicate GHSA advisory withdrawn