CVE-2025-5278
MEDIUM EPSS 11.8%
Published May 27, 20251y ago · Modified Jun 24, 20266d ago
4.4 CVSS 3.1
Published May 27, 2025 1y ago
Last Modified Jun 24, 2026 6d ago
Description
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
11.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-121
References 10
- openwall.com http://www.openwall.com/lists/oss-security/2025/05/27/2
- openwall.com http://www.openwall.com/lists/oss-security/2025/05/29/1
- openwall.com http://www.openwall.com/lists/oss-security/2025/05/29/2
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:28911
- access.redhat.com https://access.redhat.com/security/cve/CVE-2025-5278
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2368764
- cgit.git.savannah.gnu.org https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
- cgit.git.savannah.gnu.org https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14
- debbugs.gnu.org https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507
- security-tracker.debian.org https://security-tracker.debian.org/tracker/CVE-2025-5278
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.