6.1Medium
GNU mtools
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
GNU Project vulnerabilities (CVE)
CVE records published for GNU Project, newest first. Follow to get an email when a new one appears.
Binutils 65grub2 23glibc 22libredwg 14gnutls 12Emacs 9PSPP 8elfutils 6wget 5cpio 4nano 4Inetutils 4gawk 4Aspell 4Sed 4Tar 4Mailman 3wget2 3bash 3coreutils 2gzip 2ncurses 2patch 2libextractor 2libmicrohttpd 2GNU libbmicrohttpd 2Bison 2GNU SASL 2cflow 2UnRTF 1mtools 1Guix 1diffutils 1libidn 1recutils 1gcc 1sasl 1libopts 1Savane 1libtasn1 1
5.4Medium
GNU Project UnRTF
UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.
6.1Medium
GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder
GNU LibreDWG
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010…
5.9Medium
GNU Aspell
GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a reque…
7.8High
GNU Emacs
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
1.8Low
Integer Truncation Leading to Heap Corruption in GNU Aspell
GNU Aspell
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a m…
1.8Low
Out-of-bounds Read in GNU Aspell
GNU Aspell
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An a…
1.8Low
Heap Buffer Overflow in GNU Aspell's prezip utility
GNU Aspell
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. …
6.4Medium
Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address
GNU grub2
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient valida…
7.0High
GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a ma…
7.5High
GNU Emacs
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required t…
3.3Low
GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference
GNU Binutils
A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd/elfxx-x86.c of the component Dynamic Relocation Allocation. The manipulation results in null pointer dereference. The …
3.3Low
GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference
GNU Binutils
A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs…
3.3Low
GNU Binutils elflink.c elf_link_add_object_symbols null pointer dereference
GNU Binutils
A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been …
3.3Low
GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference
GNU Binutils
A security flaw has been discovered in GNU Binutils 2.47. This affects the function _bfd_elf_eh_frame_section_offset of the file bfd/elf-eh-frame.c of the component Eh Frame Handler. Performing a manipulation results in null pointer dereference. The attack mu…
7.5High
GNU libextractor before 1.15 Stack Overflow via OLE2
GNU libextractor
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that a…
5.3Medium
GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption
GNU Binutils
A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component ELF String Table. The manipulation results in memory corruption. The attack requires a local approach.…
5.3Medium
GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference
GNU Binutils
A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed lo…
5.3Medium
GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference
GNU Binutils
A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs t…
5.3Medium
GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference
GNU Binutils
A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The atta…
4.8Medium
GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow
GNU Binutils
A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cie_length/fde_length…
5.3Medium
GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow
GNU Binutils
A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An…
4.4Medium
GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference
GNU Binutils
A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to …
5.3Medium
GNU Binutils ld cache.c cache_bwrite buffer overflow
GNU Binutils
A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit…
3.3Low
GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
GNU libredwg
A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally.…