CVE-2026-35381 describes a vulnerability in the cut utility of uutils coreutils where a specific combination of options (-s with -z and -d '') triggers a logic error. The implementation incorrectly processes this combination by routing it through a newline-delimiter code path that does not check the record suppression status. Consequently, the utility fails to suppress undelimited records and emits them with a trailing NUL byte, diverging from the expected behavior of GNU coreutils. This flaw can lead to data integrity risks in automated processing pipelines that depend on cut -s to filter out undelimited data.

The vulnerability causes the cut utility to emit undelimited records instead of suppressing them when using the affected option combination. This behavior can compromise data integrity in automated pipelines that rely on cut -s to exclude such records. The CVSS score of 3.3 (low severity) reflects limited impact, with no confidentiality or availability effects and only low integrity impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should avoid using the combination of -s with -z and -d '' in uutils coreutils cut until a fix is available or consult the vendor for updates.