Null Pointer Dereference in GNU cflow Lexer Component
CVE-2025-8735
4.8MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-8735?
A problematic vulnerability has been identified in GNU cflow, specifically within the Lexer component's yylex function in the c.c file, leading to a null pointer dereference. This issue requires local access to exploit, meaning that an attacker must operate within the environment where the application is running. The vulnerability has been publicly disclosed and poses a significant risk unless properly mitigated.
Affected Version(s)
cflow 1.0
cflow 1.1
cflow 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.