Gnu
Monthly
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in GNU libextractor before 1.16 allows a low-privileged local attacker to execute arbitrary code with elevated privileges by pointing the LIBEXTRACTOR_PREFIX environment variable at a directory containing a malicious plugin, which the library loads from that untrusted search path without privilege checks. Exploitation requires a setuid or setgid consumer of libextractor to be installed and invocable on the host, so the issue is conditionally gated rather than a remote-facing emergency. Publicly available exploit code exists (a PoC repository is referenced), and the vendor has released a fix; no CISA KEV entry confirms active exploitation at time of analysis.
Arbitrary code execution in GNU Emacs 28.1 through 31.1 is triggered simply by opening a crafted file: an untrusted read-symbol-shorthands value supplied by that file reaches the Lisp reader's intern and unintern functions and is honored under Emacs's default configuration, so no special user settings or opt-ins are required. Exploitation is bounded by delivery - the attacker must get a victim to open the malicious file locally (AV:L with UI:R), and any resulting code executes with the privileges of the user running Emacs; no network service, listener, or authentication is involved. The issue carries a CVSS 4.0 score of 7.5 and is assessed under CVSS 3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact and no public exploit identified at time of analysis.
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
Unauthenticated denial of service in GNU SASL before version 2.2.3 occurs through a NULL pointer dereference in the DIGEST-MD5 authentication mechanism. Remote attackers can crash both client and server applications by sending a malformed authentication token that lacks an equals sign character, causing the getsubopt.c parser to dereference a NULL pointer.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.
Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).
GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain root access by setting the USER environment variable to '-f root' during TELNET negotiation. With EPSS 75% and KEV listing, this trivially exploitable vulnerability (CVE-2026-24061) has been widely weaponized. Public PoC is available and patches exist.
Stack memory disclosure in GNU C Library versions 2.0-2.42 allows unauthenticated remote attackers to leak sensitive stack contents via crafted DNS queries when getnetbyaddr functions are configured to use the DNS backend for network lookups. This vulnerability affects systems running vulnerable Glibc and DNS resolver combinations, with no available patch currently released.
Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.6%.
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected Linux distributions to gain root by abusing a heap buffer overflow when ld.so processes the GLIBC_TUNABLES environment variable during execution of SUID binaries. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 71.53% (99th percentile) reflects very high exploitation likelihood across Linux estates.
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Opening a crafted R2004 or R2010+ DWG file with GNU LibreDWG through 0.14.8612 can crash the parsing application and expose a small amount of process memory, because the AcDs data-section decoder indexes a static schema-property-type handler table using an unchecked 'schdat' index. The issue is local and user-assisted: an attacker must deliver the file, and a victim or an automated pipeline must actually parse it with dwgread, dwg2dxf, or any tool linked against LibreDWG; no authentication is required and default configurations are affected (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:H). No public exploit code was identified at time of analysis, and the practical impact is a medium-severity denial-of-service against DWG-processing workflows plus limited out-of-bounds information disclosure, making this a defense-in-depth file-parsing issue rather than an emergency.
Loading an attacker-supplied read-only dictionary (.rws) file in GNU Aspell through 0.60.8.2 can corrupt heap memory, yielding reliable denial of service and potentially code execution. The root cause is a heap-based buffer overflow write (CWE-122) triggered by a signed-integer overflow in String::reserve(), which lets a crafted 32-bit length field in the .rws header (for example lang_name_size = 0x7FFFFFFF, paired with the valid endian marker 12345678) bypass the capacity check so attacker-controlled data is written past an undersized allocation. Exploitation is local in nature - there is no network-service trigger - and requires the victim to actively load the malicious dictionary, such as by running 'aspell dump master <file>'; no public exploit code was identified and there is no confirmed active exploitation at time of analysis, so this is assessed as a moderate-priority issue despite the RCE tag.
Heap corruption in GNU Aspell's personal-wordlist handling lets a local attacker crash a user's spell-checking session by supplying a crafted dictionary file. All Aspell releases before 0.60.8.3 are affected: when a wordlist containing a word whose length is an exact multiple of 256 bytes is loaded, WritableDict::add() in modules/speller/default/writable.cpp stores the word length in a single byte, truncating it and corrupting heap memory, which results in denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor fix was published as commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is slated for release in version 0.60.8.3. With a CVSS 4.0 base score of 1.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, this is a genuinely low-priority issue: the attack is local-only, needs the victim to actively load an attacker-supplied dictionary, requires the specific multiple-of-256 length condition, and yields availability loss only.
Heap out-of-bounds read in GNU Aspell's binary dictionary loader (ReadOnlyDict::load() in readonly_ws.cpp) lets a crafted .rws dictionary file trigger limited heap memory disclosure or a crash of the aspell process. The victim must deliberately run aspell against the attacker-supplied dictionary via --master, --dict-dir, or an equivalent configuration setting, so the vector is local, high-complexity and dependent on user interaction, and no privileges are required (PR:N). Impact is confined to limited information disclosure and denial of service with no code execution or integrity impact, and no public exploit has been identified at time of analysis.
GNU Aspell's prezip-bin decompressor suffers a heap-based buffer overflow (CWE-122) that lets a crafted prezip-compressed file corrupt heap memory and crash the process. The issue affects Aspell versions prior to 0.60.8.3 and is only reachable through a local chain: an attacker must deliver a malicious compressed file and then persuade a user to run prezip-bin against it, so no privileges are required (PR:N) but user interaction and high attack complexity apply. The assessed impact is availability-only (VC:N/VI:N/VA:L) with a low CVSS 4.0 base score of 1.8 and an equivalent CVSS 3.1 assessment of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Multiple signals - trivial score, local-only vector, interaction requirement and crash-only outcome - converge on a genuinely low-priority issue.
GNU GRUB 2.x does not validate the MMIO base address passed to its serial command, allowing a local attacker with high privileges (PR:H) who controls GRUB's configuration to write limited non-arbitrary data to an arbitrary memory address and reset the grub_file_verifiers list, thereby loading unsigned GRUB modules while GRUB still reports lockdown as enabled. The issue only matters when Secure Boot and GRUB lockdown mode are active; it is not remotely reachable (AV:L) and requires high attack complexity (AC:H) to select a base address that yields the needed writes. A vendor fix is available as an upstream commit, but no released patched version is independently confirmed, and no public exploit identified at time of analysis.
A null pointer dereference in GNU Binutils 2.47 lets a locally-supplied malformed ELF object crash the toolchain when the linker or related BFD-consuming utilities reach the elf_x86_allocate_dynrelocs() dynamic-relocation allocator in bfd/elfxx-x86.c. Only availability is impacted — the fault aborts the affected utility and no memory corruption, information disclosure, or code execution has been demonstrated, which is consistent with the CVSS 4.0 base score of 1.9 (AV:L/PR:L, VA:L only). Publicly available exploit code exists in a GitHub proof-of-concept repository linked from the NVD record, but there is no indication of active exploitation or CISA KEV listing; upgrading to Binutils 2.48 resolves the issue.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
Denial of service in GNU Binutils 2.47: running a BFD-based utility such as objdump, readelf, nm, or ld against a crafted ELF object drives execution into the .eh_frame ('Eh Frame Handler') parsing path, where _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c dereferences a NULL pointer and crashes the process. The vector is local only - a victim must be induced to process an attacker-supplied malformed binary - and the outcome is limited to availability loss of that single tool invocation, with no confidentiality or integrity impact, which is why the supplied CVSS v4.0 base is only 1.9 and EPSS sits at 0.11% (2nd percentile). Publicly available exploit code exists (referenced from the VulDB entry and a public GitHub proof-of-concept write-up), but there is no evidence of active exploitation and the issue is not in CISA KEV; CISA's SSVC framework classifies it as poc / not automatable / partial technical impact, and no vendor-released patch has appeared because the upstream bug report (sourceware bug 34446) has not yet been answered.
Memory corruption in GNU Binutils 2.47 is triggerable locally by supplying a crafted ELF file to any Binutils tool that invokes `_bfd_elf_strtab_delref` in `bfd/elf-strtab.c`. A low-privileged local attacker can corrupt heap memory in the BFD library's ELF string table handler, potentially causing process crash, limited information disclosure, or minor data manipulation. A public proof-of-concept exists per the CVSS 4.0 E:P modifier and CVE description; no vendor patch has been released as the upstream project had not yet responded to the bug report at time of disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable `_bfd_write_merged_section` function in `bfd/merge.c`. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in `bfd_elf_set_group_contents` within `bfd/elf.c`. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
Null pointer dereference in GNU Binutils 2.47 crashes the ELF linker when processing orphan sections via a crafted object file. The flaw resides in the `elf_orphan_compatible` function in `ld/ldelf.c`, exploitable by any local user who can invoke the `ld` linker against a specially crafted ELF input. A public proof-of-concept has been posted to the upstream Bugzilla tracker (attachment #16882 / bug #34450), but as of this analysis the GNU Binutils project has not yet released a patch or responded to the disclosure.
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
A heap out-of-bounds read/write leading to a buffer overflow exists in the GNU linker (ld), part of GNU Binutils 2.47, inside the elf_x86_64_relocate_section() function of bfd/elf64-x86-64.c, triggered when the linker processes a malformed x86-64 relocation entry whose roff argument is not validated. Exploitation is local — an attacker must supply a crafted ELF object file to a link operation — and yields only limited confidentiality, integrity and availability impact (CVSS 4.0 base 1.9), but publicly available exploit code exists and a heap OOB write/SEGV proof-of-concept has been published. The flaw is fixed in Binutils 2.48 via upstream commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b; it is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed.
A null pointer dereference in the bfd_putl64() function of GNU Binutils 2.47 (bfd/libbfd.c), reachable through the ld linker component, lets a local user crash the tool by feeding it a malformed ELF file. Publicly available exploit code exists (a GitHub write-up demonstrating a SEGV), and the upstream project was notified via a Sourceware bug report but has not responded, so no fixed release has been published. Severity is low (CVSS 4.0 base 1.9) because exploitation requires local access, yields no confidentiality impact, and is limited to integrity/availability loss of the linking process.
GNU Binutils 2.47 contains a heap buffer overflow in cache_bwrite (bfd/cache.c) that is reachable when the GNU linker 'ld' processes a malformed ELF object file with the --gc-sections and -w options. Exploitation is local and low-impact per the vendor vector (CVSS 4.0 base 1.9, AV:L/PR:L, C/I/A:L), but publicly available exploit code exists, confirming the overflow is reproducible against a released version. The issue was reported upstream via Sourceware Bugzilla bug 34442 and, per the vulnerability record, the project has not responded, so no fixed release has been identified.
Null pointer dereference in GNU libredwg 0.13.4's Layer table encoding function allows a local attacker to crash any application built on the library by supplying a DWG file whose LAYER entity has no material handle assigned. The root cause is commit 27118c40 (
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases through version 5.4.0, enabling a local attacker to crash the process and theoretically achieve code execution. The RCE angle is explicitly unconfirmed by the reporter (CERT-PL), making denial-of-service the primary demonstrated impact at this time. No public exploit identified at time of analysis; an upstream source-level patch commit is available on GNU Savannah.
Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the process. Affecting all gawk versions through 5.4.0 compiled for 32-bit architectures, this flaw was reported by CERT-PL and is limited exclusively to the availability domain - the CVSS 4.0 vector confirms no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and a patch commit is available upstream.
Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhaustion when gawk processes attacker-crafted input. The flaw stems from a CWE-190 integer wraparound condition that can be triggered locally to overwrite heap objects with attacker-controlled bytes, potentially escalating from a denial-of-service to memory corruption with partial integrity impact. No public exploit identified at time of analysis, and CERT-PL reported this with a low CVSS 4.0 base score of 2.1, reflecting a limited, local attack surface with specific attack prerequisites.
Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the gawk process, causing a denial of service. All gawk versions 5.4.0 and below are affected, as confirmed by CERT-PL and an upstream patch commit. No active exploitation has been identified (not in CISA KEV), and the impact is confined to availability - no confidentiality or integrity effects have been demonstrated.
Heap-based buffer overflow in GNU LibreDWG 0.13.4-154-g0b573035 allows a local low-privileged attacker to corrupt heap memory by supplying a crafted DWG file processed through the R2004 section decompressor, yielding partial confidentiality, integrity, and availability impact. The vulnerability resides in `decompress_R2004_section` within `src/decode.c` and is exploitable whenever LibreDWG parses attacker-controlled R2004-format DWG content. A public proof-of-concept exploit file has been disclosed on GitHub; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the `dwg_next_entity` function in `src/dwg.c`, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch.
Heap-based buffer overflow in GNU LibreDWG up to version 0.13.4 allows local low-privileged attackers to corrupt heap memory via a specially crafted DWG file containing malicious BMP image data processed by the dwg_bmp function in src/dwg.c. A public proof-of-concept exploit (a crafted R13/R2000 .dwg file) has been disclosed on GitHub, raising the urgency for affected deployments that process untrusted DWG input. No confirmed active exploitation (CISA KEV) has been recorded, and a vendor-released patch in version 0.14 fully resolves the issue.
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an excessively large hunk line offset, resulting in a denial of service. The utility becomes unresponsive and must be manually terminated, impacting any pipeline, CI/CD system, or developer workflow that applies untrusted patch files. No public exploit has been identified at time of analysis, and an upstream fix commit has been published by the maintainers on Savannah; a formally tagged release is not yet independently confirmed.
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting in denial of service. Improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures, causing a NULL pointer to be passed to fwrite() during processing. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is constrained by the requirement for user interaction with a malicious file.
Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory contents by supplying two specially crafted archives - an LZW file followed by an LZH file - in a single gzip -d invocation. The shared global decompression array, never reinitialized between files in the same process invocation, is poisoned by the LZW pass and subsequently causes the LZH decoder to read past the end of the allocated buffer, yielding high confidentiality impact per the CVSS 4.0 vector (VC:H). No public exploit or CISA KEV listing has been identified at time of analysis; the fix exists as an upstream source commit only, with no confirmed packaged release.
Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a symlink attack exploiting predictable temporary filename construction. When mktemp is absent from the user's PATH, gzexe falls back to PID-based temp file naming without exclusive creation or existence checks, enabling a TOCTOU race where a pre-planted symlink redirects the write to an attacker-chosen target. No public exploit or CISA KEV listing exists at time of analysis; impact is limited to low-integrity file overwrite with a CVSS 4.0 score of 2.0.
Out-of-bounds reads of uninitialized memory in GNU libidn before version 1.44 are triggerable through the ToUnicode IDNA APIs when malformed internationalized domain name input is processed by the vulnerable function `idna_to_unicode_internal`. Applications statically or dynamically linked against affected libidn versions that pass attacker-influenced hostname strings to these APIs are exposed to integrity and availability disruption. No public exploit has been identified at time of analysis, and the successor library libidn2 is explicitly confirmed unaffected, providing a viable migration path for defenders.
Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the `_gsasl_ntlm_client_step` function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating.
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
Heap-based buffer overflow in GNU LibreDWG through version 0.13.4.8160 lets an attacker corrupt heap memory by getting the library to parse a malicious DWG file, specifically a 2004-format file with a crafted compressed section processed via the dwgbmp thumbnail-extraction utility. The flaw stems from missing bounds validation in the decompression routine and is reachable without authentication or user privileges per its CVSS vector; impact is rated low across confidentiality, integrity, and availability (CVSS 7.3). Publicly available exploit code exists (a proof-of-concept DWG sample), but the issue is not listed in CISA KEV, and an official upstream fix has been committed.
Out-of-bounds read in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) affects all versions through 0.14, allowing a local low-privileged attacker to crash the dwgbmp utility or any LibreDWG-based application by supplying a crafted DWG 2004 file with manipulated section address or size fields. Impact is limited to availability (application crash) with no confirmed confidentiality or integrity exposure per the CVSS 4.0 vector. A publicly available proof-of-concept DWG file exists on GitHub, but EPSS at 0.01% (2nd percentile) and no CISA KEV listing confirm this is not currently subject to widespread exploitation.
Null pointer dereference in GNU LibreDWG's dwggrep utility crashes the application when processing a maliciously crafted DWG file. The vulnerability resides in the match_BLOCK_HEADER function within dwggrep.c and affects all tracked releases from version 0.1 through 0.14. A local authenticated attacker can exploit this to cause denial of service against the dwggrep utility; no publicly available exploit code exists for confidentiality or integrity compromise, consistent with the CVSS impact scores of VC:N/VI:N/VA:L. Publicly available exploit code exists (no KEV listing), though EPSS at 0.01% reflects negligible widespread exploitation probability.
Out-of-bounds read in GNU LibreDWG's dwggrep utility exposes heap memory when processing maliciously crafted DWG files containing LTYPE objects with unterminated wide-character dash text strings. Affected versions span 0.1 through 0.14 (CPE: cpe:2.3:a:gnu:libredwg). A local authenticated attacker can trigger partial information disclosure by supplying a crafted DWG file to the dwggrep command-line tool; a public proof-of-concept DWG payload exists, though EPSS of 0.01% (2nd percentile) and absence from CISA KEV indicate no widespread exploitation activity at time of analysis.
Null pointer dereference in GNU LibreDWG (all versions through 0.14) allows a local, low-privileged attacker to crash any application that uses the library to parse a maliciously crafted DWG file, resulting in a denial-of-service condition with no confidentiality or integrity impact. The affected code path is within the DWG 2004 compressed-section handler in src/decode.c, where missing bounds checks on section entry address fields permit invalid memory access. A public proof-of-concept exploit file exists; however, the vulnerability is not listed in CISA KEV, EPSS sits at 0.01% (2nd percentile), and SSVC rates it non-automatable with only partial technical impact, collectively indicating negligible in-the-wild exploitation risk at time of analysis.
Heap-based buffer overflow in GNU LibreDWG's dwgread utility (versions 0.1 through 0.14) allows a local attacker with low privileges to corrupt heap memory by supplying a specially crafted R2004-format DWG file. The vulnerable function decompress_R2004_section in src/decode.c fails to validate decompression offset and size parameters before writing, enabling out-of-bounds heap writes with partial confidentiality, integrity, and availability impact. Publicly available exploit code exists as a crafted DWG file; however, no active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% (2nd percentile), and the local-only attack vector sharply constrains real-world risk.
Reachable assertion (CWE-617) in GNU LibreDWG's `decompress_R2004_section` function allows a local low-privileged attacker to crash the `dwgread` utility by supplying a malformed R2004-format DWG file with out-of-bounds decompression parameters. All releases from 0.1 through 0.14 are confirmed affected. Publicly available exploit code exists, though EPSS sits at 0.01% (2nd percentile) and no active exploitation is confirmed - consistent with the strictly local, no-code-execution impact profile.
Heap-based buffer overflow in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) exposes users of the dwgread utility to partial confidentiality, integrity, and availability compromise when processing a maliciously crafted DWG file. All released versions from 0.1 through 0.14 are affected, and a publicly available proof-of-concept exploit file exists on GitHub. No vendor patch has been issued; the project has not responded to the responsible disclosure despite early notification via issue report.
GNU wget2 incorrectly validates TLS server certificates, accepting certificates with improper Key Usage (KU) or Extended Key Usage (EKU) attributes. This allows attackers who have compromised certificates issued for non-server purposes to impersonate legitimate servers in TLS connections, enabling man-in-the-middle attacks that leak sensitive information such as authentication credentials or request/response data.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
GNU sed with -i (in-place edit) and --follow-symlinks options is vulnerable to a time-of-check-time-of-use (TOCTOU) race condition that allows local attackers to overwrite arbitrary files with attacker-controlled content. An attacker can atomically replace a symlink target between sed's symlink resolution and file open operations, causing sed to read from an attacker-chosen file while writing output to an unintended location. The vulnerability affects sed versions prior to 4.10 and requires precise timing on the same filesystem, resulting in a CVSS score of 2.1 due to low attack complexity but limited practical exploitation window.
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c.
Denial of service in GNU C Library 2.36 on x86_64 systems occurs when nscd-backed functions trigger a race condition in the optimized memcmp implementation, allowing concurrent thread modification of input data to cause application crashes. This affects any application using NSS caching functionality under high load conditions. No patch is currently available.
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. [CVSS 5.5 MEDIUM]
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. [CVSS 5.0 MEDIUM]
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation in GNU libextractor before 1.16 allows a low-privileged local attacker to execute arbitrary code with elevated privileges by pointing the LIBEXTRACTOR_PREFIX environment variable at a directory containing a malicious plugin, which the library loads from that untrusted search path without privilege checks. Exploitation requires a setuid or setgid consumer of libextractor to be installed and invocable on the host, so the issue is conditionally gated rather than a remote-facing emergency. Publicly available exploit code exists (a PoC repository is referenced), and the vendor has released a fix; no CISA KEV entry confirms active exploitation at time of analysis.
Arbitrary code execution in GNU Emacs 28.1 through 31.1 is triggered simply by opening a crafted file: an untrusted read-symbol-shorthands value supplied by that file reaches the Lisp reader's intern and unintern functions and is honored under Emacs's default configuration, so no special user settings or opt-ins are required. Exploitation is bounded by delivery - the attacker must get a victim to open the malicious file locally (AV:L with UI:R), and any resulting code executes with the privileges of the user running Emacs; no network service, listener, or authentication is involved. The issue carries a CVSS 4.0 score of 7.5 and is assessed under CVSS 3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact and no public exploit identified at time of analysis.
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.
Unauthenticated denial of service in GNU SASL before version 2.2.3 occurs through a NULL pointer dereference in the DIGEST-MD5 authentication mechanism. Remote attackers can crash both client and server applications by sending a malformed authentication token that lacks an equals sign character, causing the getsubopt.c parser to dereference a NULL pointer.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.
Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).
GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain root access by setting the USER environment variable to '-f root' during TELNET negotiation. With EPSS 75% and KEV listing, this trivially exploitable vulnerability (CVE-2026-24061) has been widely weaponized. Public PoC is available and patches exist.
Stack memory disclosure in GNU C Library versions 2.0-2.42 allows unauthenticated remote attackers to leak sensitive stack contents via crafted DNS queries when getnetbyaddr functions are configured to use the DNS backend for network lookups. This vulnerability affects systems running vulnerable Glibc and DNS resolver combinations, with no available patch currently released.
Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.6%.
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected Linux distributions to gain root by abusing a heap buffer overflow when ld.so processes the GLIBC_TUNABLES environment variable during execution of SUID binaries. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 71.53% (99th percentile) reflects very high exploitation likelihood across Linux estates.
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Opening a crafted R2004 or R2010+ DWG file with GNU LibreDWG through 0.14.8612 can crash the parsing application and expose a small amount of process memory, because the AcDs data-section decoder indexes a static schema-property-type handler table using an unchecked 'schdat' index. The issue is local and user-assisted: an attacker must deliver the file, and a victim or an automated pipeline must actually parse it with dwgread, dwg2dxf, or any tool linked against LibreDWG; no authentication is required and default configurations are affected (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:H). No public exploit code was identified at time of analysis, and the practical impact is a medium-severity denial-of-service against DWG-processing workflows plus limited out-of-bounds information disclosure, making this a defense-in-depth file-parsing issue rather than an emergency.
Loading an attacker-supplied read-only dictionary (.rws) file in GNU Aspell through 0.60.8.2 can corrupt heap memory, yielding reliable denial of service and potentially code execution. The root cause is a heap-based buffer overflow write (CWE-122) triggered by a signed-integer overflow in String::reserve(), which lets a crafted 32-bit length field in the .rws header (for example lang_name_size = 0x7FFFFFFF, paired with the valid endian marker 12345678) bypass the capacity check so attacker-controlled data is written past an undersized allocation. Exploitation is local in nature - there is no network-service trigger - and requires the victim to actively load the malicious dictionary, such as by running 'aspell dump master <file>'; no public exploit code was identified and there is no confirmed active exploitation at time of analysis, so this is assessed as a moderate-priority issue despite the RCE tag.
Heap corruption in GNU Aspell's personal-wordlist handling lets a local attacker crash a user's spell-checking session by supplying a crafted dictionary file. All Aspell releases before 0.60.8.3 are affected: when a wordlist containing a word whose length is an exact multiple of 256 bytes is loaded, WritableDict::add() in modules/speller/default/writable.cpp stores the word length in a single byte, truncating it and corrupting heap memory, which results in denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor fix was published as commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d and is slated for release in version 0.60.8.3. With a CVSS 4.0 base score of 1.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, this is a genuinely low-priority issue: the attack is local-only, needs the victim to actively load an attacker-supplied dictionary, requires the specific multiple-of-256 length condition, and yields availability loss only.
Heap out-of-bounds read in GNU Aspell's binary dictionary loader (ReadOnlyDict::load() in readonly_ws.cpp) lets a crafted .rws dictionary file trigger limited heap memory disclosure or a crash of the aspell process. The victim must deliberately run aspell against the attacker-supplied dictionary via --master, --dict-dir, or an equivalent configuration setting, so the vector is local, high-complexity and dependent on user interaction, and no privileges are required (PR:N). Impact is confined to limited information disclosure and denial of service with no code execution or integrity impact, and no public exploit has been identified at time of analysis.
GNU Aspell's prezip-bin decompressor suffers a heap-based buffer overflow (CWE-122) that lets a crafted prezip-compressed file corrupt heap memory and crash the process. The issue affects Aspell versions prior to 0.60.8.3 and is only reachable through a local chain: an attacker must deliver a malicious compressed file and then persuade a user to run prezip-bin against it, so no privileges are required (PR:N) but user interaction and high attack complexity apply. The assessed impact is availability-only (VC:N/VI:N/VA:L) with a low CVSS 4.0 base score of 1.8 and an equivalent CVSS 3.1 assessment of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Multiple signals - trivial score, local-only vector, interaction requirement and crash-only outcome - converge on a genuinely low-priority issue.
GNU GRUB 2.x does not validate the MMIO base address passed to its serial command, allowing a local attacker with high privileges (PR:H) who controls GRUB's configuration to write limited non-arbitrary data to an arbitrary memory address and reset the grub_file_verifiers list, thereby loading unsigned GRUB modules while GRUB still reports lockdown as enabled. The issue only matters when Secure Boot and GRUB lockdown mode are active; it is not remotely reachable (AV:L) and requires high attack complexity (AC:H) to select a base address that yields the needed writes. A vendor fix is available as an upstream commit, but no released patched version is independently confirmed, and no public exploit identified at time of analysis.
A null pointer dereference in GNU Binutils 2.47 lets a locally-supplied malformed ELF object crash the toolchain when the linker or related BFD-consuming utilities reach the elf_x86_allocate_dynrelocs() dynamic-relocation allocator in bfd/elfxx-x86.c. Only availability is impacted — the fault aborts the affected utility and no memory corruption, information disclosure, or code execution has been demonstrated, which is consistent with the CVSS 4.0 base score of 1.9 (AV:L/PR:L, VA:L only). Publicly available exploit code exists in a GitHub proof-of-concept repository linked from the NVD record, but there is no indication of active exploitation or CISA KEV listing; upgrading to Binutils 2.48 resolves the issue.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
Denial of service in GNU Binutils 2.47: running a BFD-based utility such as objdump, readelf, nm, or ld against a crafted ELF object drives execution into the .eh_frame ('Eh Frame Handler') parsing path, where _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c dereferences a NULL pointer and crashes the process. The vector is local only - a victim must be induced to process an attacker-supplied malformed binary - and the outcome is limited to availability loss of that single tool invocation, with no confidentiality or integrity impact, which is why the supplied CVSS v4.0 base is only 1.9 and EPSS sits at 0.11% (2nd percentile). Publicly available exploit code exists (referenced from the VulDB entry and a public GitHub proof-of-concept write-up), but there is no evidence of active exploitation and the issue is not in CISA KEV; CISA's SSVC framework classifies it as poc / not automatable / partial technical impact, and no vendor-released patch has appeared because the upstream bug report (sourceware bug 34446) has not yet been answered.
Memory corruption in GNU Binutils 2.47 is triggerable locally by supplying a crafted ELF file to any Binutils tool that invokes `_bfd_elf_strtab_delref` in `bfd/elf-strtab.c`. A low-privileged local attacker can corrupt heap memory in the BFD library's ELF string table handler, potentially causing process crash, limited information disclosure, or minor data manipulation. A public proof-of-concept exists per the CVSS 4.0 E:P modifier and CVE description; no vendor patch has been released as the upstream project had not yet responded to the bug report at time of disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local low-privileged user to crash Binutils toolchain utilities by supplying a crafted input file that triggers the vulnerable `_bfd_write_merged_section` function in `bfd/merge.c`. The Section Merge component of the BFD (Binary File Descriptor) library fails to validate a pointer before dereference, resulting in a denial of service. A proof-of-concept exploit has been publicly disclosed via VulDB and the GNU Binutils bugzilla, and no vendor patch is available as the project has not yet responded to the disclosure.
Null pointer dereference in GNU Binutils 2.47 allows a local attacker with low privileges to crash binutils tools by supplying a crafted ELF binary with a malformed SHT_GROUP section, triggering the defect in `bfd_elf_set_group_contents` within `bfd/elf.c`. A public proof-of-concept has been disclosed and the upstream project has not yet responded to the coordinated disclosure. No public exploit identified for active exploitation (not in CISA KEV); CVSS 4.0 rates this 1.9, reflecting its extremely limited real-world impact.
Null pointer dereference in GNU Binutils 2.47 crashes the ELF linker when processing orphan sections via a crafted object file. The flaw resides in the `elf_orphan_compatible` function in `ld/ldelf.c`, exploitable by any local user who can invoke the `ld` linker against a specially crafted ELF input. A public proof-of-concept has been posted to the upstream Bugzilla tracker (attachment #16882 / bug #34450), but as of this analysis the GNU Binutils project has not yet released a patch or responded to the disclosure.
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
A heap out-of-bounds read/write leading to a buffer overflow exists in the GNU linker (ld), part of GNU Binutils 2.47, inside the elf_x86_64_relocate_section() function of bfd/elf64-x86-64.c, triggered when the linker processes a malformed x86-64 relocation entry whose roff argument is not validated. Exploitation is local — an attacker must supply a crafted ELF object file to a link operation — and yields only limited confidentiality, integrity and availability impact (CVSS 4.0 base 1.9), but publicly available exploit code exists and a heap OOB write/SEGV proof-of-concept has been published. The flaw is fixed in Binutils 2.48 via upstream commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b; it is not listed in CISA KEV, so active in-the-wild exploitation is not confirmed.
A null pointer dereference in the bfd_putl64() function of GNU Binutils 2.47 (bfd/libbfd.c), reachable through the ld linker component, lets a local user crash the tool by feeding it a malformed ELF file. Publicly available exploit code exists (a GitHub write-up demonstrating a SEGV), and the upstream project was notified via a Sourceware bug report but has not responded, so no fixed release has been published. Severity is low (CVSS 4.0 base 1.9) because exploitation requires local access, yields no confidentiality impact, and is limited to integrity/availability loss of the linking process.
GNU Binutils 2.47 contains a heap buffer overflow in cache_bwrite (bfd/cache.c) that is reachable when the GNU linker 'ld' processes a malformed ELF object file with the --gc-sections and -w options. Exploitation is local and low-impact per the vendor vector (CVSS 4.0 base 1.9, AV:L/PR:L, C/I/A:L), but publicly available exploit code exists, confirming the overflow is reproducible against a released version. The issue was reported upstream via Sourceware Bugzilla bug 34442 and, per the vulnerability record, the project has not responded, so no fixed release has been identified.
Null pointer dereference in GNU libredwg 0.13.4's Layer table encoding function allows a local attacker to crash any application built on the library by supplying a DWG file whose LAYER entity has no material handle assigned. The root cause is commit 27118c40 (
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases through version 5.4.0, enabling a local attacker to crash the process and theoretically achieve code execution. The RCE angle is explicitly unconfirmed by the reporter (CERT-PL), making denial-of-service the primary demonstrated impact at this time. No public exploit identified at time of analysis; an upstream source-level patch commit is available on GNU Savannah.
Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the process. Affecting all gawk versions through 5.4.0 compiled for 32-bit architectures, this flaw was reported by CERT-PL and is limited exclusively to the availability domain - the CVSS 4.0 vector confirms no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and a patch commit is available upstream.
Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhaustion when gawk processes attacker-crafted input. The flaw stems from a CWE-190 integer wraparound condition that can be triggered locally to overwrite heap objects with attacker-controlled bytes, potentially escalating from a denial-of-service to memory corruption with partial integrity impact. No public exploit identified at time of analysis, and CERT-PL reported this with a low CVSS 4.0 base score of 2.1, reflecting a limited, local attack surface with specific attack prerequisites.
Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the gawk process, causing a denial of service. All gawk versions 5.4.0 and below are affected, as confirmed by CERT-PL and an upstream patch commit. No active exploitation has been identified (not in CISA KEV), and the impact is confined to availability - no confidentiality or integrity effects have been demonstrated.
Heap-based buffer overflow in GNU LibreDWG 0.13.4-154-g0b573035 allows a local low-privileged attacker to corrupt heap memory by supplying a crafted DWG file processed through the R2004 section decompressor, yielding partial confidentiality, integrity, and availability impact. The vulnerability resides in `decompress_R2004_section` within `src/decode.c` and is exploitable whenever LibreDWG parses attacker-controlled R2004-format DWG content. A public proof-of-concept exploit file has been disclosed on GitHub; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the `dwg_next_entity` function in `src/dwg.c`, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch.
Heap-based buffer overflow in GNU LibreDWG up to version 0.13.4 allows local low-privileged attackers to corrupt heap memory via a specially crafted DWG file containing malicious BMP image data processed by the dwg_bmp function in src/dwg.c. A public proof-of-concept exploit (a crafted R13/R2000 .dwg file) has been disclosed on GitHub, raising the urgency for affected deployments that process untrusted DWG input. No confirmed active exploitation (CISA KEV) has been recorded, and a vendor-released patch in version 0.14 fully resolves the issue.
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an excessively large hunk line offset, resulting in a denial of service. The utility becomes unresponsive and must be manually terminated, impacting any pipeline, CI/CD system, or developer workflow that applies untrusted patch files. No public exploit has been identified at time of analysis, and an upstream fix commit has been published by the maintainers on Savannah; a formally tagged release is not yet independently confirmed.
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting in denial of service. Improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures, causing a NULL pointer to be passed to fwrite() during processing. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is constrained by the requirement for user interaction with a malicious file.
Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory contents by supplying two specially crafted archives - an LZW file followed by an LZH file - in a single gzip -d invocation. The shared global decompression array, never reinitialized between files in the same process invocation, is poisoned by the LZW pass and subsequently causes the LZH decoder to read past the end of the allocated buffer, yielding high confidentiality impact per the CVSS 4.0 vector (VC:H). No public exploit or CISA KEV listing has been identified at time of analysis; the fix exists as an upstream source commit only, with no confirmed packaged release.
Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a symlink attack exploiting predictable temporary filename construction. When mktemp is absent from the user's PATH, gzexe falls back to PID-based temp file naming without exclusive creation or existence checks, enabling a TOCTOU race where a pre-planted symlink redirects the write to an attacker-chosen target. No public exploit or CISA KEV listing exists at time of analysis; impact is limited to low-integrity file overwrite with a CVSS 4.0 score of 2.0.
Out-of-bounds reads of uninitialized memory in GNU libidn before version 1.44 are triggerable through the ToUnicode IDNA APIs when malformed internationalized domain name input is processed by the vulnerable function `idna_to_unicode_internal`. Applications statically or dynamically linked against affected libidn versions that pass attacker-influenced hostname strings to these APIs are exposed to integrity and availability disruption. No public exploit has been identified at time of analysis, and the successor library libidn2 is explicitly confirmed unaffected, providing a viable migration path for defenders.
Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the `_gsasl_ntlm_client_step` function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating.
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
Heap-based buffer overflow in GNU LibreDWG through version 0.13.4.8160 lets an attacker corrupt heap memory by getting the library to parse a malicious DWG file, specifically a 2004-format file with a crafted compressed section processed via the dwgbmp thumbnail-extraction utility. The flaw stems from missing bounds validation in the decompression routine and is reachable without authentication or user privileges per its CVSS vector; impact is rated low across confidentiality, integrity, and availability (CVSS 7.3). Publicly available exploit code exists (a proof-of-concept DWG sample), but the issue is not listed in CISA KEV, and an official upstream fix has been committed.
Out-of-bounds read in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) affects all versions through 0.14, allowing a local low-privileged attacker to crash the dwgbmp utility or any LibreDWG-based application by supplying a crafted DWG 2004 file with manipulated section address or size fields. Impact is limited to availability (application crash) with no confirmed confidentiality or integrity exposure per the CVSS 4.0 vector. A publicly available proof-of-concept DWG file exists on GitHub, but EPSS at 0.01% (2nd percentile) and no CISA KEV listing confirm this is not currently subject to widespread exploitation.
Null pointer dereference in GNU LibreDWG's dwggrep utility crashes the application when processing a maliciously crafted DWG file. The vulnerability resides in the match_BLOCK_HEADER function within dwggrep.c and affects all tracked releases from version 0.1 through 0.14. A local authenticated attacker can exploit this to cause denial of service against the dwggrep utility; no publicly available exploit code exists for confidentiality or integrity compromise, consistent with the CVSS impact scores of VC:N/VI:N/VA:L. Publicly available exploit code exists (no KEV listing), though EPSS at 0.01% reflects negligible widespread exploitation probability.
Out-of-bounds read in GNU LibreDWG's dwggrep utility exposes heap memory when processing maliciously crafted DWG files containing LTYPE objects with unterminated wide-character dash text strings. Affected versions span 0.1 through 0.14 (CPE: cpe:2.3:a:gnu:libredwg). A local authenticated attacker can trigger partial information disclosure by supplying a crafted DWG file to the dwggrep command-line tool; a public proof-of-concept DWG payload exists, though EPSS of 0.01% (2nd percentile) and absence from CISA KEV indicate no widespread exploitation activity at time of analysis.
Null pointer dereference in GNU LibreDWG (all versions through 0.14) allows a local, low-privileged attacker to crash any application that uses the library to parse a maliciously crafted DWG file, resulting in a denial-of-service condition with no confidentiality or integrity impact. The affected code path is within the DWG 2004 compressed-section handler in src/decode.c, where missing bounds checks on section entry address fields permit invalid memory access. A public proof-of-concept exploit file exists; however, the vulnerability is not listed in CISA KEV, EPSS sits at 0.01% (2nd percentile), and SSVC rates it non-automatable with only partial technical impact, collectively indicating negligible in-the-wild exploitation risk at time of analysis.
Heap-based buffer overflow in GNU LibreDWG's dwgread utility (versions 0.1 through 0.14) allows a local attacker with low privileges to corrupt heap memory by supplying a specially crafted R2004-format DWG file. The vulnerable function decompress_R2004_section in src/decode.c fails to validate decompression offset and size parameters before writing, enabling out-of-bounds heap writes with partial confidentiality, integrity, and availability impact. Publicly available exploit code exists as a crafted DWG file; however, no active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% (2nd percentile), and the local-only attack vector sharply constrains real-world risk.
Reachable assertion (CWE-617) in GNU LibreDWG's `decompress_R2004_section` function allows a local low-privileged attacker to crash the `dwgread` utility by supplying a malformed R2004-format DWG file with out-of-bounds decompression parameters. All releases from 0.1 through 0.14 are confirmed affected. Publicly available exploit code exists, though EPSS sits at 0.01% (2nd percentile) and no active exploitation is confirmed - consistent with the strictly local, no-code-execution impact profile.
Heap-based buffer overflow in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) exposes users of the dwgread utility to partial confidentiality, integrity, and availability compromise when processing a maliciously crafted DWG file. All released versions from 0.1 through 0.14 are affected, and a publicly available proof-of-concept exploit file exists on GitHub. No vendor patch has been issued; the project has not responded to the responsible disclosure despite early notification via issue report.
GNU wget2 incorrectly validates TLS server certificates, accepting certificates with improper Key Usage (KU) or Extended Key Usage (EKU) attributes. This allows attackers who have compromised certificates issued for non-server purposes to impersonate legitimate servers in TLS connections, enabling man-in-the-middle attacks that leak sensitive information such as authentication credentials or request/response data.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
GNU sed with -i (in-place edit) and --follow-symlinks options is vulnerable to a time-of-check-time-of-use (TOCTOU) race condition that allows local attackers to overwrite arbitrary files with attacker-controlled content. An attacker can atomically replace a symlink target between sed's symlink resolution and file open operations, causing sed to read from an attacker-chosen file while writing output to an unintended location. The vulnerability affects sed versions prior to 4.10 and requires precise timing on the same filesystem, resulting in a CVSS score of 2.1 due to low attack complexity but limited practical exploitation window.
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c.
Denial of service in GNU C Library 2.36 on x86_64 systems occurs when nscd-backed functions trigger a race condition in the optimized memcmp implementation, allowing concurrent thread modification of input data to cause application crashes. This affects any application using NSS caching functionality under high load conditions. No patch is currently available.
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. [CVSS 5.5 MEDIUM]
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. [CVSS 5.0 MEDIUM]