CVE-2014-9488

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have...

10.0 HighFix available

CVE-2014-9488 is a high vulnerability (CVSS 10.0) in Gnu Less, published April 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.89%, the 90th percentile. Fixed in less 481-1.

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Exploit likelihood

3.89%Up 2.7 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: CVE-2014-9488
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: CVE-2014-9488
Updated: 2026-11-02

EUVDEUVD-2014-9307 No score

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: EUVD-2014-9307
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pvw4-m8q5-4fhj No score

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have...

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: GHSA-pvw4-m8q5-4fhj
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: CVE-2014-9488
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-9488 No score

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: DEBIAN-CVE-2014-9488
Updated: 2026-11-02

Show 4 moreShow less

OSVMGASA-2015-0139 No score

Updated less packages fix CVE-2014-9488

Updated less package fixes security vulnerability:

Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access (CVE-2014-9488).

Record: MGASA-2015-0139
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10183-1 No score

less-481-1.5 on GA media

These are all security issues fixed in the less-481-1.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10183-1
Updated: 2026-11-02

OSVSUSE-SU-2020:2687-1 No score

Security update for less

This update for less fixes the following issues:

Security issue fixed:

CVE-2014-9488: Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access (bsc#921719).

Record: SUSE-SU-2020:2687-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9488 No score

The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Record: UBUNTU-CVE-2014-9488
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`less` Debian:12	before 481-1	481-1
`less` Debian:13	before 481-1	481-1
`less` Debian:14	before 481-1	481-1
`less` Mageia:4	before 458-2.1.mga4	458-2.1.mga4
`less` SUSE:Linux Enterprise Server 12 SP5	before 458-7.3.3	458-7.3.3
`less` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 458-7.3.3	458-7.3.3
`less` openSUSE:Tumbleweed	before 481-1.5	481-1.5

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less