Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2026-35344

uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression

Description

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Uutils coreutils

Default version status: affected

References