bug#80960: Out-of-bounds read / information disclosure in ls (coreutils 9.10)

Paul Eggert <[email protected]> Mon, 4 May 2026 14:22:24 -0700
Newsgroups gmane.comp.gnu.core-utils.bugs
Organization UCLA Computer Science Department
Message-ID <[email protected]>
On 2026-05-04 14:09, Muhammad Abdullah Khan Niazi wrote:
> - GNU coreutils 9.10 (latest from Debian)

Thanks for reporting the problem. Unfortunately I'm not seeing the issue 
with GNU coreutils 9.10 x86-64, or with coreutils bleeding-edge, both 
running on Fedora 44. Perhaps the bug has been fixed there? Or perhaps 
the bug is in getopt and not in ls?

> The following command reproduces the issue on affected systems:
> ls -lsZXx1vUutSsRrQqpoNnmLkIiHhGgFfDdCcBbAa
> 
> text

Unfortunately that's not enough information to reproduce the bug, as I 
expect the problem depends on what directory you're running 'ls' in. Can 
you reproduce the problem in an empty directory? If not, what's the 
smallest directory that lets you reproduce the problem?