GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8697-1 advisory.

    It was discovered that GNU Core Utilities sort had a heap buffer under-read in its begfield() function. A     local attacker could possibly use this issue to cause GNU Core Utilities to crash, resulting in a denial     of service, or obtain sensitive information. (CVE-2025-5278)

    It was discovered that GNU Core Utilities uniq had an out-of-bounds read when the -w option was used with     crafted multibyte input. A local attacker could possibly use this issue to cause GNU Core Utilities to     crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu     26.04 LTS. (CVE-2026-56391)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input
    when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of
    characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in
    an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond
    the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with
    attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
    This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371. (CVE-2026-56391)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_67886 advisory.

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)

    * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67886 advisory.

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)
      * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67886 advisory.

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)

    * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67886 advisory.

    - uniq: fix CVE-2026-56391 (RHEL-216794)
      - fix read overrun with -w

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67886 advisory.

    The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used     GNU fileutils, sh-utils, and textutils packages.

    Security Fix(es):

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)

    * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-25427610bb advisory.

    * fix CVE-2026-56391

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-36041358b1 advisory.

    * fix CVE-2026-56391

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-217bb52eb2 advisory.

    Automatic update for coreutils-9.11-6.fc45.

    ##### **Changelog**

    ```
    * Mon Aug  3 2026 Luk Zaoral <lzaoral@redhat.com> - 9.11-6
    - CVE-2026-56391 - uniq: fix read overrun with -w (rhbz#2507449)
    - tee: fix infinite loop when write returns EAGAIN and short write errors

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU coreutils uniq is vulnerable to an outofbounds read due to incorrect handling of multibyte input     when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of     characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in     an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond     the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with     attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
    This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371. (CVE-2026-56391)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365429	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU Core Utilities vulnerabilities (USN-8697-1)	Nessus	Ubuntu Local Security Checks	Local	medium
462509	Echo: coreutils: security update to 9.7-3+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462509	Echo: coreutils: security update to 9.7-3+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
353834	Rocky Linux 10.2 [CIQ] Security Update: coreutils / coreutils-common / coreutils-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_67886)	Nessus	Rocky Linux Local Security Checks	Local	medium
346881	AlmaLinux 10 : coreutils (ALSA-2026:67886)	Nessus	Alma Linux Local Security Checks	Local	medium
346839	RockyLinux 10 : coreutils (RLSA-2026:67886)	Nessus	Rocky Linux Local Security Checks	Local	medium
346423	Oracle Linux 10 : coreutils (ELSA-2026-67886)	Nessus	Oracle Linux Local Security Checks	Local	medium
346281	RHEL 10 : coreutils (RHSA-2026:67886)	Nessus	Red Hat Local Security Checks	Local	medium
333256	Fedora 43 : coreutils (2026-25427610bb)	Nessus	Fedora Local Security Checks	Local	medium
332085	Fedora 44 : coreutils (2026-36041358b1)	Nessus	Fedora Local Security Checks	Local	medium
331670	Fedora 45 : coreutils (2026-217bb52eb2)	Nessus	Fedora Local Security Checks	Local	medium
329558	Linux Distros Unpatched Vulnerability : CVE-2026-56391	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-56391

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium