{"id":"CVE-2025-5278","aliases":["ALSA-2026:28911","ALSA-2026:33124","ALSA-2026:69964","AZL-93060","BELL-CVE-2025-5278","CLSA-2026-1783530353","CLSA-2026-1783532249","DEBIAN-CVE-2025-5278","EUVD-2025-16308","GHSA-ch64-4x3c-w3jq","MGASA-2025-0172","OESA-2025-1637","RHSA-2026:28911","RHSA-2026:33124","RHSA-2026:69964","RLSA-2026:28911","RLSA-2026:33124","RLSA-2026:69964","ROOT-OS-DEBIAN-12-CVE-2025-5278","SUSE-SU-2025:02353-1","SUSE-SU-2025:02354-1","SUSE-SU-2025:02362-1","SUSE-SU-2025:20523-1","SUSE-SU-2025:20660-1","UBUNTU-CVE-2025-5278","USN-8697-1","openSUSE-SU-2025:15327-1"],"status":"published","title":"Coreutils: heap buffer under-read in gnu coreutils sort via key specification","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0031,"percentile":0.24076,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2025-05-27T20:52:58Z","modified":"2026-11-06T07:39:02Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"coreutils","fixed_in":["8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"coreutils-common","fixed_in":["8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"coreutils-single","fixed_in":["8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"coreutils","fixed_in":["9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"coreutils-common","fixed_in":["9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"coreutils-single","fixed_in":["9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"coreutils","fixed_in":["8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"coreutils-common","fixed_in":["8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"coreutils-single","fixed_in":["8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"coreutils","fixed_in":["9.4-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"coreutils","fixed_in":["9.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"coreutils","fixed_in":["9.7-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"coreutils","fixed_in":["9.7-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"coreutils","fixed_in":["9.1-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"coreutils","fixed_in":["9.7-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"coreutils","fixed_in":["9.7-r2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"coreutils","fixed_in":["8.32-34.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"coreutils-common","fixed_in":["8.32-34.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"coreutils-single","fixed_in":["8.32-34.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"coreutils","fixed_in":["8.32-39.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"coreutils-common","fixed_in":["8.32-39.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"coreutils-single","fixed_in":["8.32-39.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"coreutils","fixed_in":["9.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"coreutils","fixed_in":["8.32-16.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"coreutils","fixed_in":["9.0-20.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"coreutils","fixed_in":["9.0-20.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"coreutils","fixed_in":["9.4-17.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"coreutils","fixed_in":["9.4-17.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils","fixed_in":["0:8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-debuginfo","fixed_in":["0:8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-debugsource","fixed_in":["0:8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-single","fixed_in":["0:8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-single-debuginfo","fixed_in":["0:8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils","fixed_in":["0:9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-debuginfo","fixed_in":["0:9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-debugsource","fixed_in":["0:9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-single","fixed_in":["0:9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-single-debuginfo","fixed_in":["0:9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils","fixed_in":["0:8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-debuginfo","fixed_in":["0:8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-debugsource","fixed_in":["0:8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-single","fixed_in":["0:8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-single-debuginfo","fixed_in":["0:8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"coreutils","fixed_in":["0:8.32-41.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"coreutils","fixed_in":["0:9.5-8.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"coreutils","fixed_in":["0:8.30-21.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"coreutils","fixed_in":["9.1-1.root.io.1","9.1-1.aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-coreutils","fixed_in":["9.1-1.root.io.1","9.1-1.aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"coreutils","fixed_in":["8.25-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"coreutils","fixed_in":["8.25-13.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"coreutils","fixed_in":["8.32-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"coreutils","fixed_in":["8.32-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"coreutils","fixed_in":["8.32-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"coreutils","fixed_in":["8.32-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"coreutils","fixed_in":["8.32-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"coreutils","fixed_in":["8.32-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"coreutils","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"coreutils-single","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"coreutils-testsuite","fixed_in":["8.32-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"coreutils","fixed_in":["9.4-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"coreutils","fixed_in":["9.4-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"coreutils","fixed_in":["8.32-4.1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"coreutils","fixed_in":["9.4-3ubuntu6.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"coreutils","fixed_in":["9.7-3ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"coreutils","fixed_in":["9.7-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"coreutils-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"coreutils-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"coreutils-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1-r1"},{"fixed":"9.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.7-r1"},{"fixed":"9.7-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1-r0"},{"fixed":"9.7-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1-r1"},{"fixed":"9.1-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.7-r1"},{"fixed":"9.7-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1-r0"},{"fixed":"9.7-r2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-34.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"coreutils-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-34.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-34.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-39.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"coreutils-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-39.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-39.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1-1","9.10-1","9.12-0.1","9.12-0.2","9.12-0.3","9.4-1","9.4-2","9.4-3","9.4-3.1","9.5-1","9.6-1","9.6-2","9.7-1","9.7-2","9.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.10-1","9.12-0.1","9.12-0.2","9.12-0.3","9.7-3"]},{"source":"osv","ecosystem":"Debian:14","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.10-1","9.12-0.1","9.12-0.2","9.12-0.3","9.7-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-16.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-20.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-20.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-17.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-17.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"coreutils-single-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"coreutils-single-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"coreutils-single-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.32-41.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.5-8.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.30-21.el8_10"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1.root.io.1"},{"fixed":"9.1-1.aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1.root.io.1"},{"fixed":"9.1-1.aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.25-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.25-13.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"coreutils-single","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"coreutils-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.20-3ubuntu5","8.21-1ubuntu3","8.21-1ubuntu4","8.21-1ubuntu5","8.21-1ubuntu5.1","8.21-1ubuntu5.3","8.21-1ubuntu5.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.23-4ubuntu2","8.25-2ubuntu2","8.25-2ubuntu3~16.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.26-3ubuntu4","8.28-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.30-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-4.1ubuntu1.4"}]}],"versions":["8.32-4ubuntu2","8.32-4ubuntu3","8.32-4.1ubuntu1","8.32-4.1ubuntu1.1","8.32-4.1ubuntu1.2","8.32-4.1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-3ubuntu6.3"}]}],"versions":["9.1-1ubuntu2","9.4-2ubuntu1","9.4-2ubuntu2","9.4-2ubuntu3","9.4-2ubuntu4","9.4-3ubuntu3","9.4-3ubuntu5","9.4-3ubuntu6","9.4-3ubuntu6.1","9.4-3ubuntu6.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.5-1ubuntu1","9.5-1ubuntu1.25.10.1","9.5-1ubuntu2","9.5-1ubuntu3","9.5-1ubuntu4","9.5-1ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7-3ubuntu2.1"}]}],"versions":["9.5-1ubuntu4","9.7-3ubuntu1","9.7-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.32-4.1ubuntu1.4"}]}],"versions":["8.32-4ubuntu2","8.32-4ubuntu3","8.32-4.1ubuntu1","8.32-4.1ubuntu1.1","8.32-4.1ubuntu1.2","8.32-4.1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-3ubuntu6.3"}]}],"versions":["9.1-1ubuntu2","9.4-2ubuntu1","9.4-2ubuntu2","9.4-2ubuntu3","9.4-2ubuntu4","9.4-3ubuntu3","9.4-3ubuntu5","9.4-3ubuntu6","9.4-3ubuntu6.1","9.4-3ubuntu6.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7-3ubuntu2.1"}]}],"versions":["9.5-1ubuntu4","9.7-3ubuntu1","9.7-3ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7-3.1"}]}]}],"products":[{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.17"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.18"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.20"},{"vendor":"red hat","product":"cost management 4"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat insights proxy 1.5"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3.10.1"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:28911","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33124","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33313","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33612","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34102","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39981","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44481","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46836","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50205","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69964","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72502","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82304","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82322","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82347","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82354","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82372","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82857","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82888","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5278","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2368764","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633","tags":["web","article"]},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507","tags":["web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/27/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/29/1","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-5278","tags":["web","advisory"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/29/2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5278","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ch64-4x3c-w3jq"},{"url":"https://bugzilla.redhat.com/2368764","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-28911.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-33124.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-69964.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-5278","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783530353.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783532249.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/coreutils.git/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5278.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0172.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34313","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/05/27/2","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1637","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28911.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5278","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33124.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69964.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:28911","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:33124","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69964","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502353-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243767","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5278","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502354-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219321","tags":["report"]},{"url":"https://bugzilla.suse.com/1221632","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502362-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520523-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520660-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-5278","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/bug-coreutils/2025-05/msg00036.html","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/bug-coreutils/2025-05/msg00040.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8697-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56391","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5278","title":"Coreutils: heap buffer under-read in gnu coreutils sort via key specification","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T20:52:58.545Z","modified":"2026-11-06T07:39:02.114Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T08:57:32.08691Z"}],"euvd":[{"id":"EUVD-2025-16308","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T20:52:58Z","modified":"2026-11-06T07:39:02Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T09:04:28.113071Z"}],"ghsa":[{"id":"GHSA-ch64-4x3c-w3jq","title":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap...","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T21:32:17Z","modified":"2026-10-14T21:31:44Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:13:28.606179Z"}],"nvd":[{"id":"CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T21:15:23.197Z","modified":"2026-11-06T08:17:16.323Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T11:59:54.759762Z"}],"osv":[{"id":"BELL-CVE-2025-5278","status":"published","published":"2025-05-28T05:59:13.871157Z","modified":"2026-01-26T09:40:30.843938Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-5278","title":"Coreutils: heap buffer under-read in gnu coreutils sort via key specification","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T20:52:58.545Z","modified":"2026-11-08T02:30:43.016702813Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-07T03:07:57.488512Z"},{"id":"DEBIAN-CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T21:15:23.197Z","modified":"2026-11-07T09:47:31.405897205Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2025-1637","title":"coreutils security update","description":"These are the GNU core utilities.  This package is the combination of\nthe old GNU fileutils, sh-utils, and textutils packages.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNU Coreutils. The sort utility\u0026apos;s begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.(CVE-2025-5278)","status":"published","published":"2025-06-13T11:08:43Z","modified":"2026-08-18T01:18:00.190552522Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2026:28911","title":"Red Hat Security Advisory: coreutils security update","status":"published","published":"2026-06-24T10:08:47Z","modified":"2026-10-15T10:16:25Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:33124","title":"Red Hat Security Advisory: coreutils security update","status":"published","published":"2026-06-30T10:49:28Z","modified":"2026-10-15T10:16:54Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:69964","title":"Red Hat Security Advisory: coreutils security update","status":"published","published":"2026-09-23T10:15:14Z","modified":"2026-10-15T10:25:09Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:28911","title":"Moderate: coreutils security update","description":"The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.\n\nSecurity Fix(es):\n\n* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-25T12:03:43.452279Z","modified":"2026-06-25T12:30:04.24385507Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:33124","title":"Moderate: coreutils security update","description":"The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.\n\nSecurity Fix(es):\n\n* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-05T12:05:17.112177Z","modified":"2026-07-05T12:30:04.597234214Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:69964","title":"Moderate: coreutils security update","description":"The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.\n\nSecurity Fix(es):\n\n* coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-23T06:00:55.733679Z","modified":"2026-09-23T06:30:03.142699517Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T21:15:00Z","modified":"2026-08-31T17:15:48.819967321Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"ALSA-2026:28911","title":"Moderate: coreutils security update","description":"The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.  \n\nSecurity Fix(es):  \n\n  * coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-24T00:00:00Z","modified":"2026-10-29T11:32:34.724792528Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:33124","title":"Moderate: coreutils security update","description":"The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.  \n\nSecurity Fix(es):  \n\n  * coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-29T00:00:00Z","modified":"2026-10-29T11:30:21.312393967Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:69964","title":"Moderate: coreutils security update","description":"The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages.  \n\nSecurity Fix(es):  \n\n  * coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-10-29T11:02:29.593750164Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-93060","title":"CVE-2025-5278 affecting package coreutils for versions less than 9.4-7","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.","status":"published","published":"2025-05-27T21:15:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"CLSA-2026-1783530353","title":"coreutils: Fix of CVE-2025-5278","description":"- CVE-2025-5278: sort - fix heap buffer under-read in begfield()/limfield()\n  when a traditional key specification uses a very large character position","status":"published","published":"2026-07-08T17:06:18Z","modified":"2026-10-26T09:30:25.191023726Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783532249","title":"coreutils: Fix of CVE-2025-5278","description":"- CVE-2025-5278: fix heap buffer under-read in sort key specification by\n  guarding the begfield/limfield pointer adjustment (backport of upstream\n  8c9602e3)","status":"published","published":"2026-07-08T17:37:44Z","modified":"2026-10-26T09:31:14.039882426Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2025-0172","title":"Updated coreutils packages fix security vulnerability","description":"Heap buffer under-read in gnu coreutils sort via key specification.\n(CVE-2025-5278)\n","status":"published","published":"2025-05-31T03:36:06Z","modified":"2026-04-16T04:44:36.078877522Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15327-1","title":"coreutils-9.7-3.1 on GA media","description":"These are all security issues fixed in the coreutils-9.7-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-09T00:00:00Z","modified":"2026-03-23T04:53:39.257263Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-5278","title":"CVE-2025-5278 in coreutils - Patched by Root","description":"Root has patched CVE-2025-5278 in the coreutils package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:34:07Z","modified":"2026-08-25T23:49:43.378947731Z","updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"SUSE-SU-2025:02353-1","title":"Security update for coreutils","description":"This update for coreutils fixes the following issues:\n\n- CVE-2025-5278: Fixed heap buffer under-read may lead to a crash or leak sensitive data (bsc#1243767)\n","status":"published","published":"2025-07-17T12:35:46Z","modified":"2026-03-23T04:49:38.499764Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02354-1","title":"Security update for coreutils","description":"This update for coreutils fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-5278: Fixed heap buffer under-read may lead to a crash or leak sensitive data (bsc#1243767)\n\nOther fixes:\n\n- ls: avoid triggering automounts (bsc#1221632)\n- tail: fix tailing sysfs files where PAGE_SIZE \u003e BUFSIZ (bsc#1219321)\n","status":"published","published":"2025-07-17T12:36:15Z","modified":"2026-03-23T04:48:33.975732Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02362-1","title":"Security update for coreutils","description":"This update for coreutils fixes the following issues:\n\n- CVE-2025-5278: Fixed heap buffer under-read may lead to a crash or leak sensitive data (bsc#1243767)\n","status":"published","published":"2025-07-18T09:07:36Z","modified":"2026-02-04T04:12:57.153111Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20523-1","title":"Security update for coreutils","description":"This update for coreutils fixes the following issues:\n\n- CVE-2025-5278: Fixed heap buffer under-read ledaing to a \n  crash or leak sensitive data (bsc#1243767)\n","status":"published","published":"2025-07-31T09:41:53Z","modified":"2026-03-23T04:50:51.776364Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20660-1","title":"Security update for coreutils","description":"This update for coreutils fixes the following issues:\n\n- CVE-2025-5278: Sort with key character offsets of SIZE_MAX, could induce a read of 1 byte before an allocated heap buffer (bsc#1243767).\n","status":"published","published":"2025-08-28T15:14:37Z","modified":"2026-03-23T04:50:54.268923Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-8697-1","title":"coreutils vulnerabilities","description":"It was discovered that GNU Core Utilities sort had a heap buffer under-read\nin its begfield() function. A local attacker could possibly use this issue\nto cause GNU Core Utilities to crash, resulting in a denial of service, or\nobtain sensitive information. (CVE-2025-5278)\n\nIt was discovered that GNU Core Utilities uniq had an out-of-bounds read\nwhen the -w option was used with crafted multibyte input. A local attacker\ncould possibly use this issue to cause GNU Core Utilities to crash,\nresulting in a denial of service, or obtain sensitive information. This\nissue only affected Ubuntu 26.04 LTS. (CVE-2026-56391)","status":"published","published":"2026-08-31T11:40:50Z","modified":"2026-08-31T17:26:24.789222646Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}