CVE-2014-5044

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code...

9.8 CriticalFix available

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

5.57%Up 1.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Record: CVE-2014-5044
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-190
Updated: 2026-11-02

CVE List No score

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Record: CVE-2014-5044
Updated: 2026-11-02

EUVDEUVD-2014-4943 No score

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Record: EUVD-2014-4943
Updated: 2026-11-03

GitHub AdvisoriesGHSA-45pw-v4pc-rq4g 9.8

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code...

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Record: GHSA-45pw-v4pc-rq4g
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-5044 9.8

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Record: UBUNTU-CVE-2014-5044
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2014-0306 No score

Updated gcc packages fix security vulnerability and other bugs

Updated gcc packages fix the following security issue: Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code. (CVE-2014-5044)

They also fix the following bugs: The gcc rtl-optimization sched2 miscompiles syscall sequence wich can cause random panic in glibc and kernel (gcc/PR61801)

clang++ fails to find cxxabi.h and cxxabi_tweaks.h during build (mga#13543)

Record: MGASA-2014-0306
Updated: 2026-11-02

Affected products

gnu libgfortran

Affected packages

Affected packages
Package	Affected	Fixed
`gcc` Mageia:3	before 4.7.2-8.2.mga3	4.7.2-8.2.mga3
`gcc` Mageia:4	before 4.8.2-3.2.mga4	4.8.2-3.2.mga4
`gcc-4.8` Ubuntu:14.04:LTS	before 4.8.4-2ubuntu1~14.04, plus listed versions 4.8.1-10ubuntu84.8.2-1ubuntu14.8.2-1ubuntu24.8.2-10ubuntu14.8.2-10ubuntu2 Show 14 moreShow less 4.8.2-12ubuntu24.8.2-13ubuntu14.8.2-14ubuntu14.8.2-14ubuntu24.8.2-14ubuntu44.8.2-15ubuntu34.8.2-16ubuntu14.8.2-16ubuntu34.8.2-16ubuntu44.8.2-16ubuntu54.8.2-16ubuntu64.8.2-17ubuntu14.8.2-17ubuntu24.8.2-19ubuntu1	4.8.4-2ubuntu1~14.04
`gcc-4.8-arm64-cross` Ubuntu:14.04:LTS	before 0.11.1, plus listed versions 0.90.11	0.11.1
`gcc-4.8-armhf-cross` Ubuntu:14.04:LTS	before 0.11.1, plus listed versions 0.100.11	0.11.1
`gcc-4.7` Ubuntu:14.04:LTS	All versions, plus listed versions 4.7.3-7ubuntu34.7.3-8ubuntu14.7.3-9ubuntu14.7.3-9ubuntu24.7.3-10ubuntu14.7.3-11ubuntu14.7.3-12ubuntu1	None known
`gcc-mingw-w64` Ubuntu:14.04:LTS	All versions, plus listed versions 891112	None known
`gcc-4.7` Ubuntu:16.04:LTS	All versions, plus listed versions 4.7.4-3ubuntu34.7.4-3ubuntu74.7.4-3ubuntu94.7.4-3ubuntu104.7.4-3ubuntu114.7.4-3ubuntu12	None known
`gcc-4.7-armel-cross` Ubuntu:16.04:LTS	All versions, plus listed versions 1.861.903	None known
`gcc-4.7-armhf-cross` Ubuntu:16.04:LTS	All versions, plus listed versions 1.861.873	None known
`gcc-arm-linux-androideabi` Ubuntu:16.04:LTS	All versions, plus listed versions 0.20130705.1-0ubuntu80.20130705.1-0ubuntu9	None known
`gcc-arm-none-eabi` Ubuntu:16.04:LTS	All versions, plus listed versions 15:4.9.3+svn227297-115:4.9.3+svn227297-1build115:4.9.3+svn231177-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-5044 is a critical vulnerability (CVSS 9.8) in Gnu Libgfortran, published August 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.57%, the 92nd percentile. Fixed in gcc 4.7.2-8.2.mga3.

References

Show 7 moreShow less