The vulnerability in uutils coreutils' tr utility arises from a logic error in defining the [:graph:] and [:print:] character classes. Specifically, the ASCII space character is incorrectly included in [:graph:] and excluded from [:print:], contrary to POSIX and GNU coreutils standards. This misclassification causes commands that depend on these classes to behave incorrectly, for example, deleting spaces when they should be preserved. The issue affects version 0 of the product and has a low CVSS score of 3.3. There is no vendor advisory or patch available at this time, and no known exploits in the wild.

The incorrect character class definitions can cause unintended data modification or loss in automated scripts or data-cleaning pipelines that rely on standard [:graph:] and [:print:] semantics. Specifically, commands intended to delete graphical characters while preserving spaces may delete spaces instead, potentially leading to data corruption or logic errors downstream. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when using the tr utility in uutils coreutils for operations involving [:graph:] and [:print:] character classes. Consider verifying outputs manually or using alternative tools that conform to POSIX standards for character classes.