Every CVE Search/ Get API key

CVE-2025-31181

Gnuplot: gnuplot segmentation fault on x11_graphics

6.2 MediumFix available

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.20%Up 0.2 points since Mar 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.2

Gnuplot: gnuplot segmentation fault on x11_graphics

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
CVE-2025-31181
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-05
EUVDEUVD-2025-8436 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
EUVD-2025-8436
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-fccp-q48g-r5f8 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and...

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
GHSA-fccp-q48g-r5f8
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
CVE-2025-31181
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-05
OSVAZL-59312 6.2

CVE-2025-31181 affecting package gnuplot 5.4.3-1

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
AZL-59312
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-59319 6.2

CVE-2025-31181 affecting package gnuplot for versions less than 5.4.8-2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
AZL-59319
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-07
Show 11 moreShow less
OSV 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
CVE-2025-31181
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-31181 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
DEBIAN-CVE-2025-31181
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-359 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
JLSEC-2026-359
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2154 6.2

gnuplot security update

Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms. The source code is copyrighted but freely distributed (i.e., you don't have to pay for it). It was originally created to allow scientists and students to visualize mathematical functions and data interactively, but has grown to support many non-interactive uses such as web scripting. It is also used as a plotting engine by third-party applications like Octave. Gnuplot has been supported and under active development since 1986.

Security Fix(es):

A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31176)

A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.(CVE-2025-31179)

A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31180)

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31181)

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.(CVE-2025-3359)

Record
OESA-2025-2154
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2155 6.2

gnuplot security update

Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms. The source code is copyrighted but freely distributed (i.e., you don't have to pay for it). It was originally created to allow scientists and students to visualize mathematical functions and data interactively, but has grown to support many non-interactive uses such as web scripting. It is also used as a plotting engine by third-party applications like Octave. Gnuplot has been supported and under active development since 1986.

Security Fix(es):

A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31176)

A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.(CVE-2025-31179)

A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31180)

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.(CVE-2025-31181)

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.(CVE-2025-3359)

Record
OESA-2025-2155
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-31181 6.2

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Record
UBUNTU-CVE-2025-31181
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15134-1 No score

gnuplot-6.0.2-3.1 on GA media

These are all security issues fixed in the gnuplot-6.0.2-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15134-1
Updated
2026-11-02
OSVSUSE-SU-2025:01805-1 No score

Security update for gnuplot

This update for gnuplot fixes the following issues:

  • CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
  • CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
  • CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
  • CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).
Record
SUSE-SU-2025:01805-1
Updated
2026-11-02
OSVSUSE-SU-2025:01811-1 No score

Security update for gnuplot

This update for gnuplot fixes the following issues:

  • CVE-2025-31176: invalid read leads to segmentation fault on plot3d_points (bsc#1240325).
  • CVE-2025-31177: improper bounds check leads to heap-buffer overflow on utf8_copy_one (bsc#1240326).
  • CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
  • CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
  • CVE-2025-31180: unchecked invalid pointer access leads to segmentation fault on CANVAS_text (bsc#1240329).
  • CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
  • CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).
Record
SUSE-SU-2025:01811-1
Updated
2026-11-02
OSVSUSE-SU-2025:01811-2 No score

Security update for gnuplot

This update for gnuplot fixes the following issues:

  • CVE-2025-31176: invalid read leads to segmentation fault on plot3d_points (bsc#1240325).
  • CVE-2025-31177: improper bounds check leads to heap-buffer overflow on utf8_copy_one (bsc#1240326).
  • CVE-2025-31178: unvalidated user input leads to segmentation fault on GetAnnotateString (bsc#1240327).
  • CVE-2025-31179: improper verification of time values leads to segmentation fault on xstrftime (bsc#1240328).
  • CVE-2025-31180: unchecked invalid pointer access leads to segmentation fault on CANVAS_text (bsc#1240329).
  • CVE-2025-31181: double fclose() call leads to segmentation fault on X11_graphics (bsc#1240330).
  • CVE-2025-3359: out-of-bounds read when parsing font names may lead to a segmentation fault (bsc#1241684).
Record
SUSE-SU-2025:01811-2
Updated
2026-11-02
OSVUSN-7773-1 No score

gnuplot vulnerabilities

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-3359, CVE-2025-31178, CVE-2025-31179, CVE-2025-31181)

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31176, CVE-2025-31180)

ChenYiFan Liu discovered that Gnuplot did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04. (CVE-2025-31177)

Record
USN-7773-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnuplot
Azure Linux:2
 through 5.4.3-1 None known
gnuplot
Azure Linux:3
 before 5.4.8-2
5.4.8-2
gnuplot
Debian:12
 All versions, plus listed versions
5.4.4+dfsg1-26.0.0+dfsg1-16.0.0+dfsg1-26.0.0+dfsg1-36.0.2+dfsg1-1
Show 4 moreShow less
6.0.2+dfsg1-26.0.3+dfsg1-16.0.3+dfsg1-1~exp16.0.3+dfsg1-1~exp2
 None known
gnuplot
Debian:13
 All versions, plus listed versions
6.0.2+dfsg1-16.0.2+dfsg1-26.0.3+dfsg1-16.0.3+dfsg1-1~exp16.0.3+dfsg1-1~exp2
 None known
gnuplot
Debian:14
 All versions, plus listed versions
6.0.2+dfsg1-16.0.2+dfsg1-26.0.3+dfsg1-16.0.3+dfsg1-1~exp16.0.3+dfsg1-1~exp2
 None known
Gnuplot_jll
Julia
 before 6.0.3000+0
6.0.3000+0
gnuplot
openEuler:22.03-LTS-SP3
From an advisory covering 5 CVEs
 before 5.0.6-15.oe2203sp3
5.0.6-15.oe2203sp3
gnuplot
openEuler:22.03-LTS-SP4
From an advisory covering 5 CVEs
 before 5.0.6-15.oe2203sp4
5.0.6-15.oe2203sp4
gnuplot
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 4.6.5-3.9.1
4.6.5-3.9.1
gnuplot
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
gnuplot-doc
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot-doc
openSUSE:Leap 15.6
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot-doc
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 7 CVEs
 before 5.4.3-150400.3.3.1
5.4.3-150400.3.3.1
gnuplot
Ubuntu:Pro:14.04:LTS
 before 4.6.4-2ubuntu0.1~esm2, plus listed versions
4.6.3-24.6.4-14.6.4-24.6.4-2ubuntu0.1~esm1
4.6.4-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:16.04:LTS
 before 4.6.6-3ubuntu0.1+esm2, plus listed versions
4.6.6-24.6.6-34.6.6-3ubuntu0.14.6.6-3ubuntu0.1+esm1
4.6.6-3ubuntu0.1+esm2
gnuplot
Ubuntu:Pro:18.04:LTS
 before 5.2.2+dfsg1-2ubuntu1+esm2, plus listed versions
5.0.7+dfsg1-15.2.2+dfsg1-25.2.2+dfsg1-2ubuntu15.2.2+dfsg1-2ubuntu1+esm1
5.2.2+dfsg1-2ubuntu1+esm2
gnuplot
Ubuntu:Pro:20.04:LTS
 before 5.2.8+dfsg1-2ubuntu0.1~esm2, plus listed versions
5.2.6+dfsg1-25.2.7+dfsg1-65.2.8+dfsg1-15.2.8+dfsg1-25.2.8+dfsg1-2ubuntu0.1~esm1
5.2.8+dfsg1-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:22.04:LTS
 before 5.4.2+dfsg2-2ubuntu0.1~esm1, plus listed versions
5.4.1+dfsg1-15.4.2+dfsg2-15.4.2+dfsg2-2
5.4.2+dfsg2-2ubuntu0.1~esm1
gnuplot
Ubuntu:Pro:24.04:LTS
 before 6.0.0+dfsg1-1ubuntu3+esm1, plus listed versions
5.4.4+dfsg1-2build16.0.0+dfsg1-1ubuntu26.0.0+dfsg1-1ubuntu3
6.0.0+dfsg1-1ubuntu3+esm1
gnuplot
Ubuntu:25.10
 before 6.0.2+dfsg1-2ubuntu1, plus listed versions
6.0.2+dfsg1-16.0.2+dfsg1-2
6.0.2+dfsg1-2ubuntu1
gnuplot
Ubuntu:26.04:LTS
 before 6.0.2+dfsg1-2ubuntu1
6.0.2+dfsg1-2ubuntu1
gnuplot
Ubuntu:Pro:14.04:LTS
From an advisory covering 7 CVEs
 before 4.6.4-2ubuntu0.1~esm2, plus listed versions
4.6.3-24.6.4-14.6.4-24.6.4-2ubuntu0.1~esm1
4.6.4-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:16.04:LTS
From an advisory covering 7 CVEs
 before 4.6.6-3ubuntu0.1+esm2, plus listed versions
4.6.6-24.6.6-34.6.6-3ubuntu0.14.6.6-3ubuntu0.1+esm1
4.6.6-3ubuntu0.1+esm2
gnuplot
Ubuntu:Pro:18.04:LTS
From an advisory covering 7 CVEs
 before 5.2.2+dfsg1-2ubuntu1+esm2, plus listed versions
5.0.7+dfsg1-15.2.2+dfsg1-25.2.2+dfsg1-2ubuntu15.2.2+dfsg1-2ubuntu1+esm1
5.2.2+dfsg1-2ubuntu1+esm2
gnuplot
Ubuntu:Pro:20.04:LTS
From an advisory covering 7 CVEs
 before 5.2.8+dfsg1-2ubuntu0.1~esm2, plus listed versions
5.2.6+dfsg1-25.2.7+dfsg1-65.2.8+dfsg1-15.2.8+dfsg1-25.2.8+dfsg1-2ubuntu0.1~esm1
5.2.8+dfsg1-2ubuntu0.1~esm2
gnuplot
Ubuntu:Pro:22.04:LTS
From an advisory covering 7 CVEs
 before 5.4.2+dfsg2-2ubuntu0.1~esm1, plus listed versions
5.4.1+dfsg1-15.4.2+dfsg2-15.4.2+dfsg2-2
5.4.2+dfsg2-2ubuntu0.1~esm1
gnuplot
Ubuntu:Pro:24.04:LTS
From an advisory covering 7 CVEs
 before 6.0.0+dfsg1-1ubuntu3+esm1, plus listed versions
5.4.4+dfsg1-2build16.0.0+dfsg1-1ubuntu26.0.0+dfsg1-1ubuntu3
6.0.0+dfsg1-1ubuntu3+esm1
gnuplot
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 6.0.2-3.1
6.0.2-3.1

History

History
RecordedChangedSources
affectedOSV
affectedNVD
factsCVE List, EUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31181 is a medium vulnerability (CVSS 6.2) in Gnuplot, published March 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in gnuplot 5.4.8-2.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open