CVE-2025-5278mediumCWE-121

Coreutils: heap buffer under-read in gnu coreutils sort via key specification

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.3%

exploitation probability

0.3%top 81% of all CVEs

observed exploitation

nono source reports it

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected products

coreutilsRed Hat · Cost Management 4 Red Hat · Red Hat Discovery 2 Red Hat · Red Hat Enterprise Linux 10 Red Hat · Red Hat Enterprise Linux 6 Red Hat · Red Hat Enterprise Linux 7 Red Hat · Red Hat Enterprise Linux 8 Red Hat · Red Hat Enterprise Linux 9 Red Hat · Red Hat Insights proxy 1.5 Red Hat · Red Hat OpenShift Container Platform 4 Red Hat · Red Hat OpenShift distributed tracing 3.10.2 Red Hat · Red Hat Update Infrastructure 5

References