The vulnerability in uutils coreutils' cut utility arises from a logic error that mishandles the combination of the -s (only-delimited), -z (null-terminated), and -d '' (empty delimiter) options. Specifically, the implementation incorrectly routes this option combination through a newline-delimiter code path that does not check whether records should be suppressed. As a result, cut outputs the entire record plus a NUL byte instead of suppressing undelimited records as expected. This behavior diverges from GNU coreutils and introduces a data integrity risk for automated processing pipelines that depend on cut -s to filter out undelimited data. The CVSS 3.1 base score is 3.3 (low), reflecting limited impact and requiring local privileges with low complexity.

The impact is limited to data integrity within automated pipelines using the affected cut utility options. Undelimited records that should be suppressed are instead emitted, potentially causing incorrect data processing or downstream errors. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using the combination of -s, -z, and -d '' options together in uutils coreutils cut or consider using GNU coreutils cut as an alternative if this functionality is critical.