The vulnerability in uutils coreutils ln utility arises from improper handling of Unicode encoding (CWE-176). When using the target-directory form of ln, the utility enforces UTF-8 encoding on source paths, rejecting those with non-UTF-8 filename bytes. This contrasts with GNU ln, which accepts raw byte filenames and creates links correctly. As a result, uutils coreutils fails to stat files with non-UTF-8 names, returning a non-zero exit code and causing local denial of service in environments relying on such filenames. The CVSS score is 3.3 (low), indicating limited impact confined to availability on local systems. No patch or remediation level has been provided by the vendor, and no exploits are known.

The impact is a local denial of service due to the ln utility failing to process source paths with non-UTF-8 filenames when using target-directory forms. This can disrupt automated scripts or system tasks that handle such filenames on Unix filesystems. There is no confidentiality or integrity impact reported. The issue affects availability locally and has a low severity rating. No known exploits exist in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of this limitation when using uutils coreutils ln with non-UTF-8 filenames and consider using GNU ln or alternative tools that handle raw byte filenames correctly to avoid failures.