CVE-2026-35371

Publication date 22 April 2026

Last updated 10 November 2026

Ubuntu priority

Cvss 3 Severity Score

Description

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rust-coreutils	26.10 stonking	Not affected
	26.04 LTS resolute	Vulnerable
	25.10 questing	Ignored end of life, was needed
	24.04 LTS noble	Vulnerable
	22.04 LTS jammy	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rust-coreutils	Upstream: ff382f5

Severity score breakdown

CVSS version: CVSS v3.0

Base score 3.3 · Low

Base metrics

Parameter	Value
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	Low
Availability impact	None

Scores

Parameter	Value
Base score	3.3 · Low
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Other references

https://www.cve.org/CVERecord?id=CVE-2026-35371