CVE-2026-35366
printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)
Description
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
How to fix CVE-2026-35366
To remediate CVE-2026-35366, upgrade the affected package to a fixed version below.
- —upgrade to 0.6.0 or later
- —upgrade to 0.6.0 or later
Is CVE-2026-35366 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 0.6.0
- from 0, < 0.6.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |