CVE-2026-56391 is a moderate severity vulnerability in GNU coreutils uniq affecting Red Hat Hardened Images RPMs. The flaw triggers an out-of-bounds read when uniq processes specially crafted multibyte input with the --check-chars option. This can lead to a denial of service via application crash and potential disclosure of adjacent heap memory, which might include sensitive information such as cryptographic keys or memory addresses. Exploitation requires local execution of uniq with malicious input. Red Hat's advisory confirms the vulnerability affects coreutils packages version 9.11-5.1.hum1 for aarch64 and x86_64 architectures. Currently, no mitigation or patch meeting Red Hat's standards is available.

An attacker with local access can cause uniq to crash by providing specially crafted multibyte input with the --check-chars option, resulting in denial of service. Additionally, the out-of-bounds read may disclose adjacent heap memory contents, potentially exposing sensitive information such as cryptographic keys or memory addresses. This could aid further attacks by bypassing protection mechanisms like ASLR. No remote exploitation or privilege escalation is indicated.

Red Hat states that no mitigation is currently available or meets their criteria for deployment and stability. Users should monitor Red Hat advisories for future updates. Until a fix is released, avoid running uniq with the --check-chars option on untrusted input. No official patch or workaround is presently provided.