CVE-2026-35366

Name	CVE-2026-35366
Description	The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-coreutils (PTS)	bookworm	0.0.17-2	vulnerable
	trixie	0.0.30-2	vulnerable
	forky	0.0.30-4	vulnerable
	sid	0.7.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-coreutils	source	(unstable)	0.6.0-1

Notes

https://github.com/uutils/coreutils/issues/9701
https://github.com/uutils/coreutils/pull/9728
Fixed by: https://github.com/uutils/coreutils/commit/0bfbbc00c7895c0fb6ea94987b4aab99e3d7ee52 (0.6.0)