Gnu
Monthly
Unauthenticated denial of service in GNU SASL before version 2.2.3 occurs through a NULL pointer dereference in the DIGEST-MD5 authentication mechanism. Remote attackers can crash both client and server applications by sending a malformed authentication token that lacks an equals sign character, causing the getsubopt.c parser to dereference a NULL pointer.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.
Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).
GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain root access by setting the USER environment variable to '-f root' during TELNET negotiation. With EPSS 75% and KEV listing, this trivially exploitable vulnerability (CVE-2026-24061) has been widely weaponized. Public PoC is available and patches exist.
Stack memory disclosure in GNU C Library versions 2.0-2.42 allows unauthenticated remote attackers to leak sensitive stack contents via crafted DNS queries when getnetbyaddr functions are configured to use the DNS backend for network lookups. This vulnerability affects systems running vulnerable Glibc and DNS resolver combinations, with no available patch currently released.
Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.6%.
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected Linux distributions to gain root by abusing a heap buffer overflow when ld.so processes the GLIBC_TUNABLES environment variable during execution of SUID binaries. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 71.53% (99th percentile) reflects very high exploitation likelihood across Linux estates.
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
We need produce JSON per schema. Let's analyze. CVE-2026-91779: GNU Binutils 2.47, function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, null pointer dereference, local attack, CVSS 1.9 (CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L...). CWE-476. POC publicly available. Reported by VulDB. CPE gnu:binutils. Tags: Denial Of Service, Null Pointer Dereference, Binutils, Gnu. EUVD affected: Binutils 2.47. References include sourceware bugzilla 34446, exploit GitHub. Need fields. Product name: "GNU Binutils" (1-3 words). Summary: Original synthesis. Start with impact and product. "A local null pointer dereference in GNU Binutils 2.47's ELF exception-handling frame parser allows crafted object files to crash tools like objdump, ld, or readelf..." Mention local, POC public, CVSS low 1.9, DoS only. Avoid "A vulnerability..." start. Let's craft 2-3 sentences. Technical context: Explain binutils, BFD library, elf-eh-frame.c, EH frame handling; CWE-476 null pointer dereference; local attack requires processing malicious ELF file with crafted .eh_frame section. Mention CPE gnu:binutils. Risk assessment: CVSS 4.0 1.9 with AV:L, PR:L, VA:L only; EPSS not provided; KEV not listed; POC publicly available (per input "exploit has been released to public"). Note exploitability limited: local, requires user to run binutils tool on crafted file, low impact (DoS only). State EPSS missing. SSVC not provided. Affected products: GNU Binutils 2.47; CPE gnu:binutils:*; EUVD says 2.47; references sourceware bugzilla. Remediation: No patch identified; project informed but not responded. Compensating controls: avoid processing untrusted ELF files with binutils tools, sandbox, validate input, use alternative tools, monitor for crash. Mention advisory URLs. Since patch status says not available -> "No vendor-released patch identified at time of analysis." But input says project informed but has not responded. So state that. Exploit scenario: local attacker provides mal
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
Null pointer dereference in GNU libredwg 0.13.4's Layer table encoding function allows a local attacker to crash any application built on the library by supplying a DWG file whose LAYER entity has no material handle assigned. The root cause is commit 27118c40 (
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases through version 5.4.0, enabling a local attacker to crash the process and theoretically achieve code execution. The RCE angle is explicitly unconfirmed by the reporter (CERT-PL), making denial-of-service the primary demonstrated impact at this time. No public exploit identified at time of analysis; an upstream source-level patch commit is available on GNU Savannah.
Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the process. Affecting all gawk versions through 5.4.0 compiled for 32-bit architectures, this flaw was reported by CERT-PL and is limited exclusively to the availability domain - the CVSS 4.0 vector confirms no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and a patch commit is available upstream.
Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhaustion when gawk processes attacker-crafted input. The flaw stems from a CWE-190 integer wraparound condition that can be triggered locally to overwrite heap objects with attacker-controlled bytes, potentially escalating from a denial-of-service to memory corruption with partial integrity impact. No public exploit identified at time of analysis, and CERT-PL reported this with a low CVSS 4.0 base score of 2.1, reflecting a limited, local attack surface with specific attack prerequisites.
Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the gawk process, causing a denial of service. All gawk versions 5.4.0 and below are affected, as confirmed by CERT-PL and an upstream patch commit. No active exploitation has been identified (not in CISA KEV), and the impact is confined to availability - no confidentiality or integrity effects have been demonstrated.
Heap-based buffer overflow in GNU LibreDWG 0.13.4-154-g0b573035 allows a local low-privileged attacker to corrupt heap memory by supplying a crafted DWG file processed through the R2004 section decompressor, yielding partial confidentiality, integrity, and availability impact. The vulnerability resides in `decompress_R2004_section` within `src/decode.c` and is exploitable whenever LibreDWG parses attacker-controlled R2004-format DWG content. A public proof-of-concept exploit file has been disclosed on GitHub; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the `dwg_next_entity` function in `src/dwg.c`, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch.
Heap-based buffer overflow in GNU LibreDWG up to version 0.13.4 allows local low-privileged attackers to corrupt heap memory via a specially crafted DWG file containing malicious BMP image data processed by the dwg_bmp function in src/dwg.c. A public proof-of-concept exploit (a crafted R13/R2000 .dwg file) has been disclosed on GitHub, raising the urgency for affected deployments that process untrusted DWG input. No confirmed active exploitation (CISA KEV) has been recorded, and a vendor-released patch in version 0.14 fully resolves the issue.
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an excessively large hunk line offset, resulting in a denial of service. The utility becomes unresponsive and must be manually terminated, impacting any pipeline, CI/CD system, or developer workflow that applies untrusted patch files. No public exploit has been identified at time of analysis, and an upstream fix commit has been published by the maintainers on Savannah; a formally tagged release is not yet independently confirmed.
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting in denial of service. Improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures, causing a NULL pointer to be passed to fwrite() during processing. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is constrained by the requirement for user interaction with a malicious file.
Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory contents by supplying two specially crafted archives - an LZW file followed by an LZH file - in a single gzip -d invocation. The shared global decompression array, never reinitialized between files in the same process invocation, is poisoned by the LZW pass and subsequently causes the LZH decoder to read past the end of the allocated buffer, yielding high confidentiality impact per the CVSS 4.0 vector (VC:H). No public exploit or CISA KEV listing has been identified at time of analysis; the fix exists as an upstream source commit only, with no confirmed packaged release.
Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a symlink attack exploiting predictable temporary filename construction. When mktemp is absent from the user's PATH, gzexe falls back to PID-based temp file naming without exclusive creation or existence checks, enabling a TOCTOU race where a pre-planted symlink redirects the write to an attacker-chosen target. No public exploit or CISA KEV listing exists at time of analysis; impact is limited to low-integrity file overwrite with a CVSS 4.0 score of 2.0.
Out-of-bounds reads of uninitialized memory in GNU libidn before version 1.44 are triggerable through the ToUnicode IDNA APIs when malformed internationalized domain name input is processed by the vulnerable function `idna_to_unicode_internal`. Applications statically or dynamically linked against affected libidn versions that pass attacker-influenced hostname strings to these APIs are exposed to integrity and availability disruption. No public exploit has been identified at time of analysis, and the successor library libidn2 is explicitly confirmed unaffected, providing a viable migration path for defenders.
Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the `_gsasl_ntlm_client_step` function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating.
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
Heap-based buffer overflow in GNU LibreDWG through version 0.13.4.8160 lets an attacker corrupt heap memory by getting the library to parse a malicious DWG file, specifically a 2004-format file with a crafted compressed section processed via the dwgbmp thumbnail-extraction utility. The flaw stems from missing bounds validation in the decompression routine and is reachable without authentication or user privileges per its CVSS vector; impact is rated low across confidentiality, integrity, and availability (CVSS 7.3). Publicly available exploit code exists (a proof-of-concept DWG sample), but the issue is not listed in CISA KEV, and an official upstream fix has been committed.
Out-of-bounds read in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) affects all versions through 0.14, allowing a local low-privileged attacker to crash the dwgbmp utility or any LibreDWG-based application by supplying a crafted DWG 2004 file with manipulated section address or size fields. Impact is limited to availability (application crash) with no confirmed confidentiality or integrity exposure per the CVSS 4.0 vector. A publicly available proof-of-concept DWG file exists on GitHub, but EPSS at 0.01% (2nd percentile) and no CISA KEV listing confirm this is not currently subject to widespread exploitation.
Null pointer dereference in GNU LibreDWG's dwggrep utility crashes the application when processing a maliciously crafted DWG file. The vulnerability resides in the match_BLOCK_HEADER function within dwggrep.c and affects all tracked releases from version 0.1 through 0.14. A local authenticated attacker can exploit this to cause denial of service against the dwggrep utility; no publicly available exploit code exists for confidentiality or integrity compromise, consistent with the CVSS impact scores of VC:N/VI:N/VA:L. Publicly available exploit code exists (no KEV listing), though EPSS at 0.01% reflects negligible widespread exploitation probability.
Out-of-bounds read in GNU LibreDWG's dwggrep utility exposes heap memory when processing maliciously crafted DWG files containing LTYPE objects with unterminated wide-character dash text strings. Affected versions span 0.1 through 0.14 (CPE: cpe:2.3:a:gnu:libredwg). A local authenticated attacker can trigger partial information disclosure by supplying a crafted DWG file to the dwggrep command-line tool; a public proof-of-concept DWG payload exists, though EPSS of 0.01% (2nd percentile) and absence from CISA KEV indicate no widespread exploitation activity at time of analysis.
Null pointer dereference in GNU LibreDWG (all versions through 0.14) allows a local, low-privileged attacker to crash any application that uses the library to parse a maliciously crafted DWG file, resulting in a denial-of-service condition with no confidentiality or integrity impact. The affected code path is within the DWG 2004 compressed-section handler in src/decode.c, where missing bounds checks on section entry address fields permit invalid memory access. A public proof-of-concept exploit file exists; however, the vulnerability is not listed in CISA KEV, EPSS sits at 0.01% (2nd percentile), and SSVC rates it non-automatable with only partial technical impact, collectively indicating negligible in-the-wild exploitation risk at time of analysis.
Heap-based buffer overflow in GNU LibreDWG's dwgread utility (versions 0.1 through 0.14) allows a local attacker with low privileges to corrupt heap memory by supplying a specially crafted R2004-format DWG file. The vulnerable function decompress_R2004_section in src/decode.c fails to validate decompression offset and size parameters before writing, enabling out-of-bounds heap writes with partial confidentiality, integrity, and availability impact. Publicly available exploit code exists as a crafted DWG file; however, no active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% (2nd percentile), and the local-only attack vector sharply constrains real-world risk.
Reachable assertion (CWE-617) in GNU LibreDWG's `decompress_R2004_section` function allows a local low-privileged attacker to crash the `dwgread` utility by supplying a malformed R2004-format DWG file with out-of-bounds decompression parameters. All releases from 0.1 through 0.14 are confirmed affected. Publicly available exploit code exists, though EPSS sits at 0.01% (2nd percentile) and no active exploitation is confirmed - consistent with the strictly local, no-code-execution impact profile.
Heap-based buffer overflow in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) exposes users of the dwgread utility to partial confidentiality, integrity, and availability compromise when processing a maliciously crafted DWG file. All released versions from 0.1 through 0.14 are affected, and a publicly available proof-of-concept exploit file exists on GitHub. No vendor patch has been issued; the project has not responded to the responsible disclosure despite early notification via issue report.
GNU wget2 incorrectly validates TLS server certificates, accepting certificates with improper Key Usage (KU) or Extended Key Usage (EKU) attributes. This allows attackers who have compromised certificates issued for non-server purposes to impersonate legitimate servers in TLS connections, enabling man-in-the-middle attacks that leak sensitive information such as authentication credentials or request/response data.
GNU nano creates the ~/.local directory with world-writable permissions (0777) on first use of XDG data storage features when the directory does not exist, allowing local attackers in systems with relaxed umasks (such as containers, CI/CD runners, or environments with umask 000) to write attacker-controlled files into the victim's XDG directory hierarchy via a race condition. The vulnerability affects nano versions before 9.0 and carries a CVSS score of 2.1 with CISA SSVC assessment indicating partial technical impact but no known public exploitation.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
GNU sed with -i (in-place edit) and --follow-symlinks options is vulnerable to a time-of-check-time-of-use (TOCTOU) race condition that allows local attackers to overwrite arbitrary files with attacker-controlled content. An attacker can atomically replace a symlink target between sed's symlink resolution and file open operations, causing sed to read from an attacker-chosen file while writing output to an unintended location. The vulnerability affects sed versions prior to 4.10 and requires precise timing on the same filesystem, resulting in a CVSS score of 2.1 due to low attack complexity but limited practical exploitation window.
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c.
Denial of service in GNU C Library 2.36 on x86_64 systems occurs when nscd-backed functions trigger a race condition in the optimized memcmp implementation, allowing concurrent thread modification of input data to cause application crashes. This affects any application using NSS caching functionality under high load conditions. No patch is currently available.
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. [CVSS 5.5 MEDIUM]
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. [CVSS 5.0 MEDIUM]
Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. [CVSS 7.5 HIGH]
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. [CVSS 7.6 HIGH]
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. [CVSS 8.8 HIGH]
Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. [CVSS 7.5 HIGH]
A use-after-free vulnerability exists in GRUB's gettext module where the gettext command remains registered after module unloading, allowing attackers with local access and low privileges to trigger memory corruption. Successful exploitation can lead to denial of service through GRUB crashes and potentially compromise system confidentiality and integrity. With an EPSS score of only 0.01%, real-world exploitation is currently unlikely, and patches are available from Red Hat and other vendors.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Out-of-bounds read in GNU Binutils 2.45 linker (ld) allows local authenticated attackers to read adjacent memory via manipulation of the vfinfo function in ldmisc.c, potentially disclosing sensitive information. Public exploit code is available, though the EPSS score of 0.03% indicates minimal real-world exploitation probability. The CVSS severity of 1.9 reflects limited impact (availability only) and requirement for local authenticated access.
GNU Binutils 2.45 allows local privilege-escalable information disclosure through an unchecked return value in the tg_tag_type function of prdbg.c, enabling authenticated local attackers to trigger unvalidated memory reads that leak sensitive data. CVSS score of 1.9 reflects minimal impact (availability only), though publicly available exploit code exists; EPSS 0.02% indicates negligible real-world exploitation probability despite POC availability.
Heap-based buffer overflow in GNU Binutils 2.45 linker component affects the elf_x86_64_relocate_section function, allowing authenticated local attackers to cause availability impact with low complexity exploitation. CVSS score of 1.9 reflects limited scope (availability only, no confidentiality or integrity impact), though publicly available exploit code exists and patch has been released by the upstream project.
Out-of-bounds read in GNU Binutils 2.45 linker component allows local authenticated attackers to trigger memory access violations via crafted input to the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c. The vulnerability has publicly available exploit code and requires local access with limited privileges; real-world impact is minimal availability loss (CVSS 1.9, EPSS 0.03%) rather than confidentiality or integrity compromise.
Out-of-bounds read vulnerability in GNU Binutils 2.45 linker allows local authenticated attackers to trigger memory access violations via crafted input to the get_link_hash_entry function in bfd/elflink.c. The vulnerability has low severity (CVSS 1.9) with minimal direct impact but publicly available exploit code exists. Upgrade to version 2.46 resolves the issue.
Out-of-bounds read in GNU Binutils 2.45 linker function elf_link_add_object_symbols allows local authenticated attackers to trigger memory disclosure or denial of service by providing a malformed ELF object file. Publicly available exploit code exists, though EPSS assessment indicates very low exploitation probability (0.03%) in practice. Patch available in version 2.46.
Out-of-bounds read in GNU Binutils 2.45 linker component affects the bfd_elf_gc_record_vtentry function in bfd/elflink.c, allowing authenticated local attackers to trigger memory access violations. The CVSS score of 1.9 reflects low real-world impact (no confidentiality, integrity, or system-level damage) despite the out-of-bounds read classification, suggesting this is primarily a denial-of-service vector or development/debugging concern rather than a critical exploitation pathway. Publicly available exploit code exists, but EPSS exploitation probability remains very low at 0.03 percentile, indicating minimal real-world adoption despite public disclosure.
A vulnerability has been found in GNU Binutils 2.45. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
A flaw has been found in GNU Binutils 2.45. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
A vulnerability was detected in GNU Binutils 2.45.c. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Unauthenticated denial of service in GNU SASL before version 2.2.3 occurs through a NULL pointer dereference in the DIGEST-MD5 authentication mechanism. Remote attackers can crash both client and server applications by sending a malformed authentication token that lacks an equals sign character, causing the getsubopt.c parser to dereference a NULL pointer.
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comparator function fails to correctly handle packets with duplicate sequence numbers. Remote unauthenticated attackers can send specially crafted DTLS packet sequences to trigger unstable ordering or undefined behavior, causing service disruption. No public exploit identified at time of analysis, and the issue is rated CVSS 7.5 (High) for availability impact only.
Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.
Out-of-bounds write in GNU C Library 2.2+ allows remote unauthenticated attackers to corrupt memory and potentially execute arbitrary code through specially crafted TSIG DNS records processed by deprecated ns_printrrf, ns_printrr, or fp_nquery functions. While these functions are deprecated, any application still using them for DNS record printing remains vulnerable to network-based attacks with low complexity and no authentication barriers. No public exploit identified at time of analysis, but the deprecated status suggests limited real-world exposure despite the network attack vector.
OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.
Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).
GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain root access by setting the USER environment variable to '-f root' during TELNET negotiation. With EPSS 75% and KEV listing, this trivially exploitable vulnerability (CVE-2026-24061) has been widely weaponized. Public PoC is available and patches exist.
Stack memory disclosure in GNU C Library versions 2.0-2.42 allows unauthenticated remote attackers to leak sensitive stack contents via crafted DNS queries when getnetbyaddr functions are configured to use the DNS backend for network lookups. This vulnerability affects systems running vulnerable Glibc and DNS resolver combinations, with no available patch currently released.
Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.6%.
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected Linux distributions to gain root by abusing a heap buffer overflow when ld.so processes the GLIBC_TUNABLES environment variable during execution of SUID binaries. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 71.53% (99th percentile) reflects very high exploitation likelihood across Linux estates.
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
We need produce JSON per schema. Let's analyze. CVE-2026-91779: GNU Binutils 2.47, function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, null pointer dereference, local attack, CVSS 1.9 (CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L...). CWE-476. POC publicly available. Reported by VulDB. CPE gnu:binutils. Tags: Denial Of Service, Null Pointer Dereference, Binutils, Gnu. EUVD affected: Binutils 2.47. References include sourceware bugzilla 34446, exploit GitHub. Need fields. Product name: "GNU Binutils" (1-3 words). Summary: Original synthesis. Start with impact and product. "A local null pointer dereference in GNU Binutils 2.47's ELF exception-handling frame parser allows crafted object files to crash tools like objdump, ld, or readelf..." Mention local, POC public, CVSS low 1.9, DoS only. Avoid "A vulnerability..." start. Let's craft 2-3 sentences. Technical context: Explain binutils, BFD library, elf-eh-frame.c, EH frame handling; CWE-476 null pointer dereference; local attack requires processing malicious ELF file with crafted .eh_frame section. Mention CPE gnu:binutils. Risk assessment: CVSS 4.0 1.9 with AV:L, PR:L, VA:L only; EPSS not provided; KEV not listed; POC publicly available (per input "exploit has been released to public"). Note exploitability limited: local, requires user to run binutils tool on crafted file, low impact (DoS only). State EPSS missing. SSVC not provided. Affected products: GNU Binutils 2.47; CPE gnu:binutils:*; EUVD says 2.47; references sourceware bugzilla. Remediation: No patch identified; project informed but not responded. Compensating controls: avoid processing untrusted ELF files with binutils tools, sandbox, validate input, use alternative tools, monitor for crash. Mention advisory URLs. Since patch status says not available -> "No vendor-released patch identified at time of analysis." But input says project informed but has not responded. So state that. Exploit scenario: local attacker provides mal
GNU Binutils 2.47 contains a heap out-of-bounds write in the ELF `.eh_frame` handler `_bfd_elf_write_section_eh_frame`, triggered when a malformed object file causes the library to compute a negative size that is then passed to a `memmove` during section rewriting. The attack is local: an attacker must get a crafted ELF file processed by a BFD-based tool (such as `ld`, `objcopy`, or `strip`) on the target system, after which the process can corrupt heap memory and crash. Exploit code is publicly available, though the CVSS 4.0 base score is only 0.9 because the required privileges, user interaction, and limited observed impact keep real-world severity low; there is no CISA KEV listing, and upstream has not responded to the bug report.
Null pointer dereference in GNU libredwg 0.13.4's Layer table encoding function allows a local attacker to crash any application built on the library by supplying a DWG file whose LAYER entity has no material handle assigned. The root cause is commit 27118c40 (
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
Heap buffer overflow in GNU Emacs for Android's TrueType font parser (sfnt_read_name_table() in src/sfnt.c) enables potential code execution when a 32-bit Emacs process loads a crafted font file. The root cause is a CWE-190 integer overflow that wraps a 32-bit allocation size calculation, producing an undersized heap buffer that a subsequent read() call overflows. Delivery is possible through multiple standard Emacs workflows - email rendering, EWW web browsing, or documents with custom font faces - requiring only passive user interaction, with no authentication required from the attacker. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though a patch commit is confirmed upstream.
Heap buffer overflow via integer wraparound in GNU Emacs for Android's TrueType font parser allows an attacker to corrupt heap memory and potentially achieve code execution by delivering a crafted font file through email, the built-in EWW browser, or documents using custom typefaces. The flaw is confined to 32-bit builds where an unguarded addition in sfnt_read_cmap_format_12() wraps around when computing an xmalloc allocation size, producing a fatally undersized heap buffer. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, CERT-PL reported the issue and an upstream patch commit is available.
GNU Emacs for Android leaks heap memory contents through a crafted TrueType variable font, enabling ASLR bypass as a stepping stone to further exploitation. The flaw resides in the gvar table parser (src/sfnt.c), where an off-by-one error in shared-coordinate index boundary checks allows a font file to trigger an out-of-bounds heap read via memcpy. Attack delivery is broad: malicious fonts can reach victims through email rendered in Emacs, EWW (Emacs Web Wowser) browsing, or documents applying custom faces - all requiring user interaction but no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix commit is available but no formally released patched version has been independently confirmed.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.
Heap-based buffer overflow in GNU coreutils unexpand allows an attacker who can supply large tab stop (-t) values to cause a denial of service and potentially achieve a heap write primitive. The flaw affects coreutils versions up to 9.11 and was fixed in commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d. No active exploitation is known, and EPSS predicts a 0.15% likelihood of exploitation.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
Stack-based buffer overflow in gawk's readdir extension (extension/readdir.c, ftype() routine) affects all gawk releases through version 5.4.0, enabling a local attacker to crash the process and theoretically achieve code execution. The RCE angle is explicitly unconfirmed by the reporter (CERT-PL), making denial-of-service the primary demonstrated impact at this time. No public exploit identified at time of analysis; an upstream source-level patch commit is available on GNU Savannah.
Integer overflow in gawk's do_sub() routine (builtin.c) enables heap metadata corruption on 32-bit builds, crashing the process. Affecting all gawk versions through 5.4.0 compiled for 32-bit architectures, this flaw was reported by CERT-PL and is limited exclusively to the availability domain - the CVSS 4.0 vector confirms no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and a patch commit is available upstream.
Integer overflow in GNU gawk's builtin.c (versions 5.4.0 and below) enables heap metadata corruption and memory exhaustion when gawk processes attacker-crafted input. The flaw stems from a CWE-190 integer wraparound condition that can be triggered locally to overwrite heap objects with attacker-controlled bytes, potentially escalating from a denial-of-service to memory corruption with partial integrity impact. No public exploit identified at time of analysis, and CERT-PL reported this with a low CVSS 4.0 base score of 2.1, reflecting a limited, local attack surface with specific attack prerequisites.
Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the gawk process, causing a denial of service. All gawk versions 5.4.0 and below are affected, as confirmed by CERT-PL and an upstream patch commit. No active exploitation has been identified (not in CISA KEV), and the impact is confined to availability - no confidentiality or integrity effects have been demonstrated.
Heap-based buffer overflow in GNU LibreDWG 0.13.4-154-g0b573035 allows a local low-privileged attacker to corrupt heap memory by supplying a crafted DWG file processed through the R2004 section decompressor, yielding partial confidentiality, integrity, and availability impact. The vulnerability resides in `decompress_R2004_section` within `src/decode.c` and is exploitable whenever LibreDWG parses attacker-controlled R2004-format DWG content. A public proof-of-concept exploit file has been disclosed on GitHub; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
Null pointer dereference in GNU LibreDWG up to 0.13.4 allows a local low-privileged attacker to crash any application that processes a maliciously crafted DWG file via the `dwg_next_entity` function in `src/dwg.c`, resulting in denial of service. A proof-of-concept exploit file is publicly available (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. The issue is fully resolved by upgrading to version 0.14, which includes a committed upstream patch.
Heap-based buffer overflow in GNU LibreDWG up to version 0.13.4 allows local low-privileged attackers to corrupt heap memory via a specially crafted DWG file containing malicious BMP image data processed by the dwg_bmp function in src/dwg.c. A public proof-of-concept exploit (a crafted R13/R2000 .dwg file) has been disclosed on GitHub, raising the urgency for affected deployments that process untrusted DWG input. No confirmed active exploitation (CISA KEV) has been recorded, and a vendor-released patch in version 0.14 fully resolves the issue.
GNU patch enters an infinite CPU-consuming loop when processing a specially crafted unified-diff file containing an excessively large hunk line offset, resulting in a denial of service. The utility becomes unresponsive and must be manually terminated, impacting any pipeline, CI/CD system, or developer workflow that applies untrusted patch files. No public exploit has been identified at time of analysis, and an upstream fix commit has been published by the maintainers on Savannah; a formally tagged release is not yet independently confirmed.
GNU patch crashes with a NULL pointer dereference when a user applies a specially crafted unified-diff file, resulting in denial of service. Improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures, causing a NULL pointer to be passed to fwrite() during processing. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is constrained by the requirement for user interaction with a malicious file.
Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory contents by supplying two specially crafted archives - an LZW file followed by an LZH file - in a single gzip -d invocation. The shared global decompression array, never reinitialized between files in the same process invocation, is poisoned by the LZW pass and subsequently causes the LZH decoder to read past the end of the allocated buffer, yielding high confidentiality impact per the CVSS 4.0 vector (VC:H). No public exploit or CISA KEV listing has been identified at time of analysis; the fix exists as an upstream source commit only, with no confirmed packaged release.
Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a symlink attack exploiting predictable temporary filename construction. When mktemp is absent from the user's PATH, gzexe falls back to PID-based temp file naming without exclusive creation or existence checks, enabling a TOCTOU race where a pre-planted symlink redirects the write to an attacker-chosen target. No public exploit or CISA KEV listing exists at time of analysis; impact is limited to low-integrity file overwrite with a CVSS 4.0 score of 2.0.
Out-of-bounds reads of uninitialized memory in GNU libidn before version 1.44 are triggerable through the ToUnicode IDNA APIs when malformed internationalized domain name input is processed by the vulnerable function `idna_to_unicode_internal`. Applications statically or dynamically linked against affected libidn versions that pass attacker-influenced hostname strings to these APIs are exposed to integrity and availability disruption. No public exploit has been identified at time of analysis, and the successor library libidn2 is explicitly confirmed unaffected, providing a viable migration path for defenders.
Memory disclosure in GNU SASL's NTLM client implementation allows a malicious or man-in-the-middle server to extract portions of client process memory by delivering a crafted undersized challenge to the `_gsasl_ntlm_client_step` function. All GNU SASL versions before 2.2.4 are affected, with the fix confirmed in the 2.2.4 release and a Debian security advisory issued downstream. No active exploitation has been identified; the high attack complexity required to position a malicious NTLM server tempers the already-low CVSS 3.7 rating.
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
Heap-based buffer overflow in GNU LibreDWG through version 0.13.4.8160 lets an attacker corrupt heap memory by getting the library to parse a malicious DWG file, specifically a 2004-format file with a crafted compressed section processed via the dwgbmp thumbnail-extraction utility. The flaw stems from missing bounds validation in the decompression routine and is reachable without authentication or user privileges per its CVSS vector; impact is rated low across confidentiality, integrity, and availability (CVSS 7.3). Publicly available exploit code exists (a proof-of-concept DWG sample), but the issue is not listed in CISA KEV, and an official upstream fix has been committed.
Out-of-bounds read in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) affects all versions through 0.14, allowing a local low-privileged attacker to crash the dwgbmp utility or any LibreDWG-based application by supplying a crafted DWG 2004 file with manipulated section address or size fields. Impact is limited to availability (application crash) with no confirmed confidentiality or integrity exposure per the CVSS 4.0 vector. A publicly available proof-of-concept DWG file exists on GitHub, but EPSS at 0.01% (2nd percentile) and no CISA KEV listing confirm this is not currently subject to widespread exploitation.
Null pointer dereference in GNU LibreDWG's dwggrep utility crashes the application when processing a maliciously crafted DWG file. The vulnerability resides in the match_BLOCK_HEADER function within dwggrep.c and affects all tracked releases from version 0.1 through 0.14. A local authenticated attacker can exploit this to cause denial of service against the dwggrep utility; no publicly available exploit code exists for confidentiality or integrity compromise, consistent with the CVSS impact scores of VC:N/VI:N/VA:L. Publicly available exploit code exists (no KEV listing), though EPSS at 0.01% reflects negligible widespread exploitation probability.
Out-of-bounds read in GNU LibreDWG's dwggrep utility exposes heap memory when processing maliciously crafted DWG files containing LTYPE objects with unterminated wide-character dash text strings. Affected versions span 0.1 through 0.14 (CPE: cpe:2.3:a:gnu:libredwg). A local authenticated attacker can trigger partial information disclosure by supplying a crafted DWG file to the dwggrep command-line tool; a public proof-of-concept DWG payload exists, though EPSS of 0.01% (2nd percentile) and absence from CISA KEV indicate no widespread exploitation activity at time of analysis.
Null pointer dereference in GNU LibreDWG (all versions through 0.14) allows a local, low-privileged attacker to crash any application that uses the library to parse a maliciously crafted DWG file, resulting in a denial-of-service condition with no confidentiality or integrity impact. The affected code path is within the DWG 2004 compressed-section handler in src/decode.c, where missing bounds checks on section entry address fields permit invalid memory access. A public proof-of-concept exploit file exists; however, the vulnerability is not listed in CISA KEV, EPSS sits at 0.01% (2nd percentile), and SSVC rates it non-automatable with only partial technical impact, collectively indicating negligible in-the-wild exploitation risk at time of analysis.
Heap-based buffer overflow in GNU LibreDWG's dwgread utility (versions 0.1 through 0.14) allows a local attacker with low privileges to corrupt heap memory by supplying a specially crafted R2004-format DWG file. The vulnerable function decompress_R2004_section in src/decode.c fails to validate decompression offset and size parameters before writing, enabling out-of-bounds heap writes with partial confidentiality, integrity, and availability impact. Publicly available exploit code exists as a crafted DWG file; however, no active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% (2nd percentile), and the local-only attack vector sharply constrains real-world risk.
Reachable assertion (CWE-617) in GNU LibreDWG's `decompress_R2004_section` function allows a local low-privileged attacker to crash the `dwgread` utility by supplying a malformed R2004-format DWG file with out-of-bounds decompression parameters. All releases from 0.1 through 0.14 are confirmed affected. Publicly available exploit code exists, though EPSS sits at 0.01% (2nd percentile) and no active exploitation is confirmed - consistent with the strictly local, no-code-execution impact profile.
Heap-based buffer overflow in GNU LibreDWG's read_2004_compressed_section function (src/decode.c) exposes users of the dwgread utility to partial confidentiality, integrity, and availability compromise when processing a maliciously crafted DWG file. All released versions from 0.1 through 0.14 are affected, and a publicly available proof-of-concept exploit file exists on GitHub. No vendor patch has been issued; the project has not responded to the responsible disclosure despite early notification via issue report.
GNU wget2 incorrectly validates TLS server certificates, accepting certificates with improper Key Usage (KU) or Extended Key Usage (EKU) attributes. This allows attackers who have compromised certificates issued for non-server purposes to impersonate legitimate servers in TLS connections, enabling man-in-the-middle attacks that leak sensitive information such as authentication credentials or request/response data.
GNU nano creates the ~/.local directory with world-writable permissions (0777) on first use of XDG data storage features when the directory does not exist, allowing local attackers in systems with relaxed umasks (such as containers, CI/CD runners, or environments with umask 000) to write attacker-controlled files into the victim's XDG directory hierarchy via a race condition. The vulnerability affects nano versions before 9.0 and carries a CVSS score of 2.1 with CISA SSVC assessment indicating partial technical impact but no known public exploitation.
Memory corruption in GNU Emacs SVG/CSS processing allows local attackers to trigger denial of service or information disclosure by convincing users to open specially crafted SVG files. The vulnerability requires user interaction (file opening) and local access, but results in significant impact including service disruption and potential data leakage through memory corruption exploitation.
GNU sed with -i (in-place edit) and --follow-symlinks options is vulnerable to a time-of-check-time-of-use (TOCTOU) race condition that allows local attackers to overwrite arbitrary files with attacker-controlled content. An attacker can atomically replace a symlink target between sed's symlink resolution and file open operations, causing sed to read from an attacker-chosen file while writing output to an unintended location. The vulnerability affects sed versions prior to 4.10 and requires precise timing on the same filesystem, resulting in a CVSS score of 2.1 due to low attack complexity but limited practical exploitation window.
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cause a Denial of Service (DoS) via the function decompress_R2004_section at decode.c.
Denial of service in GNU C Library 2.36 on x86_64 systems occurs when nscd-backed functions trigger a race condition in the optimized memcmp implementation, allowing concurrent thread modification of input data to cause application crashes. This affects any application using NSS caching functionality under high load conditions. No patch is currently available.
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. [CVSS 6.2 MEDIUM]
GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. [CVSS 7.5 HIGH]
GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. [CVSS 5.5 MEDIUM]
Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. [CVSS 5.5 MEDIUM]
An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. [CVSS 5.0 MEDIUM]
Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. [CVSS 7.5 HIGH]
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. [CVSS 7.6 HIGH]
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. [CVSS 8.8 HIGH]
Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. [CVSS 7.5 HIGH]
A use-after-free vulnerability exists in GRUB's gettext module where the gettext command remains registered after module unloading, allowing attackers with local access and low privileges to trigger memory corruption. Successful exploitation can lead to denial of service through GRUB crashes and potentially compromise system confidentiality and integrity. With an EPSS score of only 0.01%, real-world exploitation is currently unlikely, and patches are available from Red Hat and other vendors.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Out-of-bounds read in GNU Binutils 2.45 linker (ld) allows local authenticated attackers to read adjacent memory via manipulation of the vfinfo function in ldmisc.c, potentially disclosing sensitive information. Public exploit code is available, though the EPSS score of 0.03% indicates minimal real-world exploitation probability. The CVSS severity of 1.9 reflects limited impact (availability only) and requirement for local authenticated access.
GNU Binutils 2.45 allows local privilege-escalable information disclosure through an unchecked return value in the tg_tag_type function of prdbg.c, enabling authenticated local attackers to trigger unvalidated memory reads that leak sensitive data. CVSS score of 1.9 reflects minimal impact (availability only), though publicly available exploit code exists; EPSS 0.02% indicates negligible real-world exploitation probability despite POC availability.
Heap-based buffer overflow in GNU Binutils 2.45 linker component affects the elf_x86_64_relocate_section function, allowing authenticated local attackers to cause availability impact with low complexity exploitation. CVSS score of 1.9 reflects limited scope (availability only, no confidentiality or integrity impact), though publicly available exploit code exists and patch has been released by the upstream project.
Out-of-bounds read in GNU Binutils 2.45 linker component allows local authenticated attackers to trigger memory access violations via crafted input to the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c. The vulnerability has publicly available exploit code and requires local access with limited privileges; real-world impact is minimal availability loss (CVSS 1.9, EPSS 0.03%) rather than confidentiality or integrity compromise.
Out-of-bounds read vulnerability in GNU Binutils 2.45 linker allows local authenticated attackers to trigger memory access violations via crafted input to the get_link_hash_entry function in bfd/elflink.c. The vulnerability has low severity (CVSS 1.9) with minimal direct impact but publicly available exploit code exists. Upgrade to version 2.46 resolves the issue.
Out-of-bounds read in GNU Binutils 2.45 linker function elf_link_add_object_symbols allows local authenticated attackers to trigger memory disclosure or denial of service by providing a malformed ELF object file. Publicly available exploit code exists, though EPSS assessment indicates very low exploitation probability (0.03%) in practice. Patch available in version 2.46.
Out-of-bounds read in GNU Binutils 2.45 linker component affects the bfd_elf_gc_record_vtentry function in bfd/elflink.c, allowing authenticated local attackers to trigger memory access violations. The CVSS score of 1.9 reflects low real-world impact (no confidentiality, integrity, or system-level damage) despite the out-of-bounds read classification, suggesting this is primarily a denial-of-service vector or development/debugging concern rather than a critical exploitation pathway. Publicly available exploit code exists, but EPSS exploitation probability remains very low at 0.03 percentile, indicating minimal real-world adoption despite public disclosure.
A vulnerability has been found in GNU Binutils 2.45. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
A flaw has been found in GNU Binutils 2.45. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
A vulnerability was detected in GNU Binutils 2.45.c. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.