CVE-2026-35344
LOWDescription
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
Is your site exposed to CVE-2026-35344?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| uutils | coreutils |
References
Other References
Frequently Asked Questions
What is CVE-2026-35344? +
How severe is CVE-2026-35344? +
What products are affected by CVE-2026-35344? +
How do I check if I'm vulnerable to CVE-2026-35344? +
Related Vulnerabilities
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and …
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error …
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an …
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP …
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary …
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table …
