CVE-2025-5278Coreutils: heap buffer under-read in gnu coreutils sort via key specification
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux 10 and 7 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
- CVSS
- 4.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
- Weakness (CWE)
- CWE-121
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Deferred
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:9.5-8.el10_2 not affected | CNA record |
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 redhat:cert_manager | from 1791371080 not affected | CNA record |
Red Hat Cost Management 4 redhat:cost_management | from 1783539156 not affected | CNA record |
Red Hat Red Hat Discovery 2 redhat:discovery | from 1782756541 not affected | CNA record |
Red Hat Red Hat Insights proxy 1.5 redhat:insights_proxy | from 1782890503 not affected | CNA record |
Red Hat Red Hat OpenShift distributed tracing 3.10.2 redhat:openshift_distributed_tracing | from 1782501180 not affected | CNA record |
Red Hat Red Hat Update Infrastructure 5 redhat:rhui | from 1784794818 not affected | CNA record |
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift | 4 | CNA record |
References
- https://access.redhat.com/errata/RHSA-2026:28911vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:33124vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:33313vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:33612vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:34102vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:39981vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:44481vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:46836vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:50205vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:58981vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69964vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:72502vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82304vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82322vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82347vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82354vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82372vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82857vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:82888vendor-advisory, x-refsource-redhat
- https://access.redhat.com/security/cve/CVE-2025-5278vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2368764issue-tracking, x-refsource-redhat
- https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507
- http://www.openwall.com/lists/oss-security/2025/05/27/2
- http://www.openwall.com/lists/oss-security/2025/05/29/1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.