CVE-2026-35366 is a vulnerability in the printenv utility of uutils coreutils where environment variables containing invalid UTF-8 byte sequences are not displayed. Instead of printing the raw bytes as POSIX permits, the utility silently skips these entries. This improper handling (CWE-754) can allow malicious environment variables, for example adversarial LD_PRELOAD values, to evade detection during environment inspection, potentially facilitating environment-based attacks such as library injection. The vulnerability affects uutils coreutils version 0. No official remediation or patch is currently documented.

Malicious environment variables with invalid UTF-8 byte sequences can be hidden from administrators and security auditing tools because printenv does not display them. This can allow attackers to conceal environment-based attacks, such as injecting malicious libraries via LD_PRELOAD, increasing the risk of undetected compromise or persistence. The confidentiality and integrity of the system environment may be impacted, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be aware that printenv may not show all environment variables if they contain invalid UTF-8 sequences. Alternative inspection methods that do not rely on UTF-8 validation should be used to detect suspicious environment variables.