Every CVE Search/ Get API key

CVE-2025-31177

Gnuplot: gnuplot heap-buffer overflow on utf8_copy_one

5.5 MediumFix available

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.21%Up 0.2 points since May 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.5

Gnuplot: gnuplot heap-buffer overflow on utf8_copy_one

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
CVE-2025-31177
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-05
EUVDEUVD-2025-13933 5.5

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
EUVD-2025-13933
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-xjcf-jhr2-9x97 6.2

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
GHSA-xjcf-jhr2-9x97
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 5.5

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
CVE-2025-31177
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-05
OSV 5.5

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
CVE-2025-31177
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-31177 5.5

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
DEBIAN-CVE-2025-31177
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2025-31177 5.5

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
UBUNTU-CVE-2025-31177
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-110388 No score

CVE-2025-31177 affecting package gnuplot 5.4.8-2

gnuplot is affected by a heap buffer overflow at function utf8_copy_one.

Record
AZL-110388
Updated
2026-11-05
OSVopenSUSE-SU-2025:15134-1 No score

gnuplot-6.0.2-3.1 on GA media

These are all security issues fixed in the gnuplot-6.0.2-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15134-1
Updated
2026-11-02
OSVSUSE-SU-2025:01811-1 No score

Security update for gnuplot

This update for gnuplot fixes the following issues:

  • CVE-2025-31176: invalid read leads to segmentation fault on plot3d_points (bsc#1240325).
  • CVE-2025-31177: improper bounds check leads to heap-buffer overflow on utf8_copy_one (bsc#1240326).
  • CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
  • CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
  • CVE-2025-31180: unchecked invalid pointer access leads to segmentation fault on CANVAS_text (bsc#1240329).
  • CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
  • CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).
Record
SUSE-SU-2025:01811-1
Updated
2026-11-02
OSVSUSE-SU-2025:01811-2 No score

Security update for gnuplot

This update for gnuplot fixes the following issues:

  • CVE-2025-31176: invalid read leads to segmentation fault on plot3d_points (bsc#1240325).
  • CVE-2025-31177: improper bounds check leads to heap-buffer overflow on utf8_copy_one (bsc#1240326).
  • CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
  • CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
  • CVE-2025-31180: unchecked invalid pointer access leads to segmentation fault on CANVAS_text (bsc#1240329).
  • CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
  • CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).
Record
SUSE-SU-2025:01811-2
Updated
2026-11-02
OSVUSN-7773-1 No score

gnuplot vulnerabilities

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-3359, CVE-2025-31178, CVE-2025-31179, CVE-2025-31181)

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31176, CVE-2025-31180)

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31177)

Record
USN-7773-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnuplot
Azure Linux:3
 through 5.4.8-2 None known
gnuplot
Debian:12
 All versions, plus listed versions
5.4.4+dfsg1-26.0.0+dfsg1-16.0.0+dfsg1-26.0.0+dfsg1-36.0.2+dfsg1-1
Show 4 moreShow less
6.0.2+dfsg1-26.0.3+dfsg1-16.0.3+dfsg1-1~exp16.0.3+dfsg1-1~exp2
 None known
gnuplot
Debian:13
 All versions, plus listed versions
6.0.2+dfsg1-16.0.2+dfsg1-26.0.3+dfsg1-16.0.3+dfsg1-1~exp16.0.3+dfsg1-1~exp2
 None known
gnuplot
Debian:14
 All versions, plus listed versions
6.0.2+dfsg1-16.0.2+dfsg1-26.0.3+dfsg1-16.0.3+dfsg1-1~exp16.0.3+dfsg1-1~exp2
 None known
gnuplot
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot-doc
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot-doc
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot-doc
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
gnuplot
Ubuntu:Pro:18.04:LTS
 before 5.2.2+dfsg1-2ubuntu1+esm2, plus listed versions
5.0.7+dfsg1-15.2.2+dfsg1-25.2.2+dfsg1-2ubuntu15.2.2+dfsg1-2ubuntu1+esm1
5.2.2+dfsg1-2ubuntu1+esm2
gnuplot
Ubuntu:Pro:20.04:LTS
 before 5.2.8+dfsg1-2ubuntu0.1~esm2, plus listed versions
5.2.6+dfsg1-25.2.7+dfsg1-65.2.8+dfsg1-15.2.8+dfsg1-25.2.8+dfsg1-2ubuntu0.1~esm1
5.2.8+dfsg1-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:22.04:LTS
 before 5.4.2+dfsg2-2ubuntu0.1~esm1, plus listed versions
5.4.1+dfsg1-15.4.2+dfsg2-15.4.2+dfsg2-2
5.4.2+dfsg2-2ubuntu0.1~esm1
gnuplot
Ubuntu:Pro:24.04:LTS
 before 6.0.0+dfsg1-1ubuntu3+esm1, plus listed versions
5.4.4+dfsg1-2build16.0.0+dfsg1-1ubuntu26.0.0+dfsg1-1ubuntu3
6.0.0+dfsg1-1ubuntu3+esm1
gnuplot
Ubuntu:25.10
 before 6.0.2+dfsg1-2ubuntu1, plus listed versions
6.0.2+dfsg1-16.0.2+dfsg1-2
6.0.2+dfsg1-2ubuntu1
gnuplot
Ubuntu:26.04:LTS
 before 6.0.2+dfsg1-2ubuntu1
6.0.2+dfsg1-2ubuntu1
gnuplot
Ubuntu:Pro:14.04:LTS
From an advisory covering 7 CVEs
 before 4.6.4-2ubuntu0.1~esm2, plus listed versions
4.6.3-24.6.4-14.6.4-24.6.4-2ubuntu0.1~esm1
4.6.4-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:16.04:LTS
From an advisory covering 7 CVEs
 before 4.6.6-3ubuntu0.1+esm2, plus listed versions
4.6.6-24.6.6-34.6.6-3ubuntu0.14.6.6-3ubuntu0.1+esm1
4.6.6-3ubuntu0.1+esm2
gnuplot
Ubuntu:Pro:18.04:LTS
From an advisory covering 7 CVEs
 before 5.2.2+dfsg1-2ubuntu1+esm2, plus listed versions
5.0.7+dfsg1-15.2.2+dfsg1-25.2.2+dfsg1-2ubuntu15.2.2+dfsg1-2ubuntu1+esm1
5.2.2+dfsg1-2ubuntu1+esm2
gnuplot
Ubuntu:Pro:20.04:LTS
From an advisory covering 7 CVEs
 before 5.2.8+dfsg1-2ubuntu0.1~esm2, plus listed versions
5.2.6+dfsg1-25.2.7+dfsg1-65.2.8+dfsg1-15.2.8+dfsg1-25.2.8+dfsg1-2ubuntu0.1~esm1
5.2.8+dfsg1-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:22.04:LTS
From an advisory covering 7 CVEs
 before 5.4.2+dfsg2-2ubuntu0.1~esm1, plus listed versions
5.4.1+dfsg1-15.4.2+dfsg2-15.4.2+dfsg2-2
5.4.2+dfsg2-2ubuntu0.1~esm1
gnuplot
Ubuntu:Pro:24.04:LTS
From an advisory covering 7 CVEs
 before 6.0.0+dfsg1-1ubuntu3+esm1, plus listed versions
5.4.4+dfsg1-2build16.0.0+dfsg1-1ubuntu26.0.0+dfsg1-1ubuntu3
6.0.0+dfsg1-1ubuntu3+esm1
gnuplot
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 6.0.2-3.1
6.0.2-3.1

History

History
RecordedChangedSources
affectedNVD
factsCVE List, EUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31177 is a medium vulnerability (CVSS 5.5) in Gnuplot, published May 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in gnuplot 5.2.2+dfsg1-2ubuntu1+esm2.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open