The uutils coreutils sort utility has a vulnerability (CVE-2026-35348) related to improper handling of non-UTF-8 filenames when using the --files0-from option. The implementation expects UTF-8 encoded input and uses expect() calls that cause an immediate crash if a filename is valid but not UTF-8 encoded. This behavior differs from GNU sort, which treats filenames as raw bytes and does not crash. The vulnerability allows a local attacker with limited privileges to cause a denial of service by crashing the sort utility, potentially disrupting automated pipelines relying on it.

This vulnerability results in a denial of service (process crash) when the sort utility encounters non-UTF-8 filenames with the --files0-from option. There is no impact on confidentiality or integrity, only availability is affected. The attacker must have local access and the ability to supply crafted input filenames. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the --files0-from option with inputs that may contain non-UTF-8 filenames in uutils coreutils sort. Consider using GNU sort as an alternative if non-UTF-8 filenames are expected.