4.4
Medium
A flaw was found in GNU Coreutils.
CVE-2025-5278
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
Assessment
- CVSS
- 4.4 (v3.1)
- Severity
- Medium
- EPSS
- 0.31% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 May 2025
- Last updated
- 31 October 2026
- Affected
- Red Hat
- Assigner
- redhat
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
At the source
References
- https://access.redhat.com/errata/RHSA-2026:28911
- https://access.redhat.com/errata/RHSA-2026:33124
- https://access.redhat.com/errata/RHSA-2026:33313
- https://access.redhat.com/errata/RHSA-2026:33612
- https://access.redhat.com/errata/RHSA-2026:34102
- https://access.redhat.com/errata/RHSA-2026:39981
- https://access.redhat.com/errata/RHSA-2026:44481
- https://access.redhat.com/errata/RHSA-2026:46836
- https://access.redhat.com/errata/RHSA-2026:50205
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/errata/RHSA-2026:69964
- https://access.redhat.com/errata/RHSA-2026:72502
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2025-5278