CVE-2026-35343 describes a control flow implementation flaw in the cut utility of uutils coreutils. Specifically, when the -s option is used with a newline delimiter, the function cut_fields_newline_char_delim fails to verify the only_delimited flag properly. This causes the utility to output lines that do not contain the delimiter, contrary to expected behavior. The incorrect control flow leads to unexpected data leakage to downstream processes that depend on filtered output. The vulnerability is rated low severity with a CVSS score of 3.3 and currently has no official remediation or patch available.

The vulnerability can cause the cut utility to output lines that should have been suppressed, potentially leading to unexpected or unintended data being passed to downstream scripts or processes. This may affect the integrity of data processing pipelines relying on strict delimiter-based filtering. There is no impact on confidentiality or availability, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious when using the -s option with newline delimiters in the cut utility of uutils coreutils. Consider alternative tools or manual verification of output to ensure data integrity.