CVE-2025-5278
- Source
- https://cve.org/CVERecord?id=CVE-2025-5278
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5278.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-5278
- Downstream
- Related
- Published
- 2025-05-27T21:15:23.197Z
- Modified
- 2026-04-16T04:32:25.167759225Z
- Severity
-
- 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
- References
-
- https://access.redhat.com/security/cve/CVE-2025-5278
- https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
- http://www.openwall.com/lists/oss-security/2025/05/27/2
- http://www.openwall.com/lists/oss-security/2025/05/29/1
- http://www.openwall.com/lists/oss-security/2025/05/29/2
- https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14
- https://security-tracker.debian.org/tracker/CVE-2025-5278
- https://bugzilla.redhat.com/show_bug.cgi?id=2368764