CVE-2026-35371

lowCVSS 3.3covered by 1 sourcefirst seen 2026-07-06

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control. _Zellic finding 3.73. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242._

⚡ Watch CVE-2026-35371

Get an email if CVE-2026-35371 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.

Advisory coverage (1)

lowGHSA-xv5w-cw7x-72gj: id: pretty-print uses effective GID instead of effective UID for name lookupghsa · 2026-07-06

External references

NVD record for CVE-2026-35371

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-35371 status](https://www.csirts.com/badge/CVE-2026-35371)](https://www.csirts.com/cve/CVE-2026-35371)