What is the CVSS score of CVE-2025-31178?

CVE-2025-31178 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gnuplot are affected by CVE-2025-31178?

Organizations using A flaw should be aware of moderate risk from CVE-2025-31178, a null pointer dereference vulnerability rated CVSS 6.2.. A patch is available.

How to fix or mitigate CVE-2025-31178?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Gnuplot CVE-2025-31178

MEDIUM

NULL Pointer Dereference (CWE-476)

2025-03-27 secalert@redhat.com

Null Pointer Dereference Denial Of Service Gnuplot

6.2

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Red Hat

6.2 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 05, 2026 - 20:30 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:33 vuln.today

CVE Published

Mar 27, 2025 - 15:16 nvd

MEDIUM 6.2

DescriptionCVE.org

A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.

AnalysisAI

A flaw was found in gnuplot. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash. Affected products include: Gnuplot.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.

More in Gnuplot

View all

CVE-2020-25412 CRITICAL Act Now POC

9.8 Sep 16

com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code ex

CVE-2020-25559 HIGH This Week POC

7.8 Sep 16

gnuplot 5.5 is affected by double free when executing print_set_output. Rated high severity (CVSS 7.8), this vulnerabili

CVE-2018-19492 HIGH This Week POC

7.8 Nov 23

An issue was discovered in cairo.trm in Gnuplot 5.2.5. Rated high severity (CVSS 7.8), this vulnerability is no authenti

CVE-2018-19491 HIGH This Week POC

7.8 Nov 23

An issue was discovered in post.trm in Gnuplot 5.2.5. Rated high severity (CVSS 7.8), this vulnerability is no authentic

CVE-2018-19490 HIGH This Week POC

7.8 Nov 23

An issue was discovered in datafile.c in Gnuplot 5.2.5. Rated high severity (CVSS 7.8), this vulnerability is no authent

CVE-2021-29369 CRITICAL Act Now

9.8 May 03

The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot command

CVE-2021-44917 MEDIUM This Month POC

5.5 Dec 21

A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithm

CVE-2017-9670 HIGH This Week

7.8 Jun 15

An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cau

CVE-2025-31181 MEDIUM This Month

6.2 Mar 27

A flaw was found in gnuplot. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low att

CVE-2025-31180 MEDIUM This Month

6.2 Mar 27

A flaw was found in gnuplot. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low att

CVE-2025-31179 MEDIUM This Month

6.2 Mar 27

A flaw was found in gnuplot. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low att

CVE-2025-31176 MEDIUM This Month

6.2 Mar 27

A flaw was found in gnuplot. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low att

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Null Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed

CVE-2025-31178 vulnerability details – vuln.today

Back

Gnuplot CVE-2025-31178

Severity by source

CVSS VectorVendor: redhat

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Gnuplot

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Null Pointer Dereference

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code