This vulnerability arises from a logic error in the cut utility of uutils coreutils where the literal two-byte string of two single quotes ('') is misinterpreted as an empty delimiter. The implementation maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. As a result, automated scripts and data pipelines that rely on these delimiters may experience silent data corruption or logic errors due to unintended splitting or joining on NUL bytes rather than the expected literal characters. The CVSS 3.1 base score is 5.5 (medium severity), reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no known exploit in the wild and no vendor advisory or patch currently available.

The vulnerability can cause silent data corruption or logic errors in automated scripts and data pipelines that use the cut utility with the affected delimiter options. Specifically, data may be incorrectly split or joined on NUL bytes instead of the intended literal two single quote characters, potentially leading to incorrect processing or data integrity issues. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the two single quote string ('') as a delimiter with the cut utility in uutils coreutils or validate outputs carefully to detect potential data corruption. Monitor vendor channels for updates or patches addressing this issue.