CVE-2025-5278: Coreutils: heap buffer under-read in gnu coreutils sort via key specification

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-27 · updated 2026-10-31
Weakness: CWE-121

Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Affected products

coreutils: from 7.2 before 9.8 — fixed in 9.8
Red Hat Cert Manager support for Red Hat OpenShift release 1.17: all versions — fixed in 1791371080
Red Hat Cert Manager support for Red Hat OpenShift release 1.18: all versions — fixed in 1791459707
Red Hat Cert Manager support for Red Hat OpenShift release 1.20: all versions — fixed in 1790598593
Red Hat Cost Management 4: all versions — fixed in 1783539156
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Discovery 2: all versions — fixed in 1782756541
Red Hat Enterprise Linux 10: all versions — fixed in 0:9.5-8.el10_2
Red Hat Enterprise Linux 8: all versions — fixed in 0:8.30-21.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:8.32-41.el9_8
Red Hat Insights proxy 1.5: all versions — fixed in 1782890503
Red Hat OpenShift distributed tracing 3.10.1: all versions — fixed in 1782501180
Red Hat Update Infrastructure 5: all versions — fixed in 1784794818

How to fix

Upgrade to a fixed version: coreutils 9.8; Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371080; Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1791459707; Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790598593; Red Hat Cost Management 4 1783539156; Red Hat Discovery 2 1782756541; Red Hat Enterprise Linux 10 0:9.5-8.el10_2; Red Hat Enterprise Linux 8 0:8.30-21.el8_10; Red Hat Enterprise Linux 9 0:8.32-41.el9_8; Red Hat Insights proxy 1.5 1782890503; Red Hat OpenShift distributed tracing 3.10.1 1782501180; Red Hat Update Infrastructure 5 1784794818. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-5278 or the next vulnerability affects your stack