CVE-2026-35371

Medium

Published: —Translated: 06/07/2026(UTC)NVD NIST

Summary

The 'id' utility in uutils coreutils incorrectly displays data in 'pretty print' mode when the real UID differs from the effective UID. The implementation mistakenly uses the effective GID instead of the effective UID when looking up the name of the effective user, leading to misleading output.

Risk Assessment

Incorrect display of user identity may mislead administrators about the actual privileges of a process, potentially resulting in flawed security or audit decisions.

Recommendation

It is recommended to update the uutils coreutils package to a version containing the fix for CVE-2026-35371. If an update is not available, avoid relying on the 'pretty print' mode of the 'id' utility in scenarios with differing UIDs.

Original NVD description (English source)

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading