GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.

ubuntu_linux USN-8697-1: Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : GNU Core Utilities vulnerabilities (USN-8697-1)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67886 advisory.

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)
      * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67886 advisory.

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)

    * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67886 advisory.

    - uniq: fix CVE-2026-56391 (RHEL-216794)
      - fix read overrun with -w

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67886 advisory.

    The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used     GNU fileutils, sh-utils, and textutils packages.

    Security Fix(es):

    * coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with     multibyte input (CVE-2026-56391)

    * coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values (CVE-2026-56392)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-25427610bb advisory.

    * fix CVE-2026-56391

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-36041358b1 advisory.

    * fix CVE-2026-56391

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-217bb52eb2 advisory.

    Automatic update for coreutils-9.11-6.fc45.

    ##### **Changelog**

    ```
    * Mon Aug  3 2026 Luk Zaoral <lzaoral@redhat.com> - 9.11-6
    - CVE-2026-56391 - uniq: fix read overrun with -w (rhbz#2507449)
    - tee: fix infinite loop when write returns EAGAIN and short write errors

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU coreutils uniq is vulnerable to an outofbounds read due to incorrect handling of multibyte input     when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of     characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in     an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond     the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with     attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
    This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371. (CVE-2026-56391)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346881	AlmaLinux 10 : coreutils (ALSA-2026:67886)	Nessus	Alma Linux Local Security Checks	Local	medium
346839	RockyLinux 10 : coreutils (RLSA-2026:67886)	Nessus	Rocky Linux Local Security Checks	Local	medium
346423	Oracle Linux 10 : coreutils (ELSA-2026-67886)	Nessus	Oracle Linux Local Security Checks	Local	medium
346281	RHEL 10 : coreutils (RHSA-2026:67886)	Nessus	Red Hat Local Security Checks	Local	medium
333256	Fedora 43 : coreutils (2026-25427610bb)	Nessus	Fedora Local Security Checks	Local	medium
332085	Fedora 44 : coreutils (2026-36041358b1)	Nessus	Fedora Local Security Checks	Local	medium
331670	Fedora 45 : coreutils (2026-217bb52eb2)	Nessus	Fedora Local Security Checks	Local	medium
329558	Linux Distros Unpatched Vulnerability : CVE-2026-56391	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-56391

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium