CVE-2025-5001mediumCWE-189CWE-190

CVE-2025-5001: medium-severity vulnerability in GNU PSPP

GNU PSPP pspp-convert.c calloc integer overflow

Published · Updated

Follow this CVE+ Monitor PSPP+ Monitor pspp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.3%
A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function calloc of the file pspp-convert.c. The manipulation of the argument -l leads to integer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
GNU · PSPP
Related CVEs — GNU PSPP

In the same product, most dangerous first.

CVE-2025-47816LOWCVE-2025-47816EPSS 0.4%CVE-2025-47814MEDIUMCVE-2025-47814EPSS 0.3%CVE-2025-47815MEDIUMCVE-2025-47815EPSS 0.3%CVE-2025-47229LOWCVE-2025-47229EPSS 0.2%CVE-2025-5899MEDIUMGNU PSPP pspp-convert.c parse_variables_option free of memory not on the heapEPSS 0.2%CVE-2025-5898MEDIUMGNU PSPP pspp-convert.c parse_variables_option out-of-bounds writeEPSS 0.2%