CVE-2026-35371

EUVD-2026-25019

22.04.2026, 17:16

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.36%

Affected Products (NVD)

Vendor	Product	Version
uutils	coreutils	-

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

rust-coreutils

bookworm	no-dsa
forky	vulnerable
sid	vulnerable
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

rust-coreutils

jammy	dne
noble	needed
questing	ignored
resolute	needed

Known Exploits!

Common Weakness Enumeration

CWE-451 - User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

References

https://github.com/uutils/coreutils/issues/10006