The vulnerability in uutils coreutils split utility involves a logic error related to Unicode encoding handling. When non-UTF-8 prefix or suffix inputs are provided, the utility uses to_string_lossy() to generate chunk filenames, which replaces invalid byte sequences with the UTF-8 replacement character (U+FFFD). This behavior differs from GNU split, which preserves raw pathname bytes. As a result, in non-UTF-8 environments, output filenames can be corrupted, potentially causing filename collisions and automation failures.

The impact is limited to the integrity of output filenames generated by the split utility in uutils coreutils when handling non-UTF-8 encoded inputs. This can cause filename collisions, broken automation workflows, or misdirection of output data. There is no direct confidentiality, availability, or system compromise impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when using the split utility with non-UTF-8 encoded prefixes or suffixes and consider using GNU split as an alternative if filename integrity is critical.