Heap Buffer Under-read Vulnerability in GNU Coreutils Sort Utility
CVE-2025-5278

4.4MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 27 May 2025

What is CVE-2025-5278?

A vulnerability exists in the GNU Coreutils where the sort utility's begfield() function can be exploited through a heap buffer under-read. This flaw can allow malicious users to execute crafted commands that access memory outside of the allocated buffer, potentially leading to application crashes or exposing sensitive information. Ensuring that users are aware of this issue is essential to maintaining system integrity and data security.

References

https://access.redhat.com/security/cve/CVE-2025-5278

vdb-entryx_refsource_REDHAT

https://bugzilla.redhat.com/show_bug.cgi?id=2368764

issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:

4.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 27, 2025
Vulnerability Reserved
May 27, 2025

Credit

Red Hat would like to thank Mohamed Maatallah for reporting this issue.