Skip to content
Fencer Vulns
medium 4.4

CVE-2025-5278 json

Coreutils: heap buffer under-read in gnu coreutils sort via key specification

published 2025-05-27 17 mo ago modified 2026-11-06 3 d ago also EUVD-2025-16308

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:9.5-8.el10_2
  • Red Hat Red Hat Enterprise Linux 8 0:8.30-21.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:8.32-41.el9_8
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371069, 1791371080, 1791788287, 1791970484
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790598593
  • Red Hat Cost Management 4 1783539156
  • Red Hat Red Hat Discovery 2 1782756541, 1784821670
  • Red Hat Red Hat Insights proxy 1.5 1782890503
  • Red Hat Red Hat OpenShift distributed tracing 3.10.1 1782498923, 1782501180, 1782501195, 1782501196, 1782501200, 1782501220, 1782510941, 1785704547, 1785704636
  • Red Hat Red Hat Update Infrastructure 5 1784794289, 1784794778, 1784794818, 1784795076, 1784795112, 1787135742, 1787241211, 1787241260
  • coreutils Ubuntu 22.04 LTS 8.32-4.1ubuntu1.4
  • coreutils Ubuntu 24.04 LTS 9.4-3ubuntu6.3
  • coreutils Ubuntu 26.04 LTS 9.7-3ubuntu2.1

ubuntu advisories UBUNTU-CVE-2025-5278

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • coreutils RHEL 8 8.30-21.el8_10
  • coreutils-single RHEL 8 8.30-21.el8_10
  • coreutils RHEL 10.2 9.5-8.el10_2
  • coreutils-single RHEL 10.2 9.5-8.el10_2
  • coreutils RHEL 9 8.32-41.el9_8
  • coreutils-single RHEL 9 8.32-41.el9_8

red hat advisories RHSA-2026:69964RHSA-2026:33124RHSA-2026:28911

  • coreutils Linux Micro 6.1 9.4-slfo.1.1_2.1
  • coreutils Linux Micro 6.0 9.4-5.1
  • coreutils SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +13 more 8.32-150400.9.9.1
  • coreutils-single openSUSE Leap 15.6 8.32-150400.9.9.1
  • coreutils-testsuite openSUSE Leap 15.6 8.32-150400.9.9.1
  • coreutils SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 8.32-150300.3.11.1
  • coreutils SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 8.25-13.19.1

suse advisories SUSE-SU-2025:20660-1SUSE-SU-2025:20523-1SUSE-SU-2025:02362-1SUSE-SU-2025:02354-1SUSE-SU-2025:02353-1

  • coreutils openSUSE Tumbleweed 9.7-3.1

opensuse advisories openSUSE-SU-2025:15327-1

  • coreutils AlmaLinux 8 8.30-21.el8_10
  • coreutils-common AlmaLinux 8 8.30-21.el8_10
  • coreutils-single AlmaLinux 8 8.30-21.el8_10
  • coreutils AlmaLinux 10 9.5-8.el10_2
  • coreutils-common AlmaLinux 10 9.5-8.el10_2
  • coreutils-single AlmaLinux 10 9.5-8.el10_2
  • coreutils AlmaLinux 9 8.32-41.el9_8
  • coreutils-common AlmaLinux 9 8.32-41.el9_8

almalinux advisories ALSA-2026:69964ALSA-2026:33124ALSA-2026:28911

  • coreutils Rocky Linux 8 8.30-21.el8_10
  • coreutils Rocky Linux 10 9.5-8.el10_2
  • coreutils Rocky Linux 9 8.32-41.el9_8

rocky linux advisories RLSA-2026:69964RLSA-2026:33124RLSA-2026:28911

  • coreutils Azure Linux 3.0 9.4-7

azure linux advisories AZL-93060

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-5278 updated cvss 4.4

coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification

  • Red Hat Enterprise Linux 6 coreutils, coreutils-libs Red Hat Enterprise Linux 7 coreutils
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82888
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-trust-manager-rhel9 1790598593
    fixed: vendor fix RHSA-2026:72502
  • Red Hat Cost Management 4 costmanagement/costmanagement-metrics-rhel9-operator 1783539156
    fixed: vendor fix RHSA-2026:39981
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1782756541, discovery/discovery-server-rhel9 1784821670
    fixed: vendor fix RHSA-2026:46836
  • Red Hat Enterprise Linux BaseOS (v. 8) coreutils 8.30-21.el8_10, coreutils-single 8.30-21.el8_10
    fixed: vendor fix RHSA-2026:69964
show 6 more
  • Red Hat Enterprise Linux BaseOS (v. 9) coreutils 8.32-41.el9_8, coreutils-single 8.32-41.el9_8
    fixed: vendor fix RHSA-2026:28911
  • Red Hat Enterprise Linux BaseOS (v. 10) coreutils 9.5-8.el10_2, coreutils-single 9.5-8.el10_2
    fixed: vendor fix RHSA-2026:33124
  • Red Hat Insights proxy 1.5 insights-proxy/insights-proxy-container-rhel9 1782890503
    fixed: vendor fix RHSA-2026:34102
  • Red Hat OpenShift distributed tracing 3.10.1 rhosdt/tempo-rhel9 1782501196, rhosdt/tempo-query-rhel9 1782501220, rhosdt/tempo-gateway-rhel9 1782501200, rhosdt/tempo-rhel9-operator 1782501195, rhosdt/tempo-operator-bundle 1782510941, rhosdt/tempo-gateway-opa-rhel9 1782501180, +3 more
    fixed: vendor fix RHSA-2026:50205
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1784794778, rhui5/rhua-rhel9 1784795076, rhui5/haproxy-rhel9 1784795112, rhui5/rhua-tp-rhel9 1787241260, rhui5/installer-rhel9 1784794289, rhui5/installer-tp-rhel9 1787135742, +2 more
    fixed: vendor fix RHSA-2026:44481
  • Red Hat Cost Management 4 costmanagement/costmanagement-metrics-operator-bundle 1783613222 Red Hat Discovery 2 discovery/discovery-ui-rhel9 1784821750, discovery/discovery-server-rhel9 1782763840 Red Hat Enterprise Linux BaseOS (v. 8) coreutils-common 8.30-21.el8_10 Red Hat Enterprise Linux BaseOS (v. 9) coreutils-common 8.32-41.el9_8 Red Hat Enterprise Linux BaseOS (v. 10) coreutils-common 9.5-8.el10_2 Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-k8s-operator-rhel9
    +2 more products
    Red Hat OpenShift distributed tracing 3.10.1 rhosdt/opentelemetry-operator-bundle 1785744179, rhosdt/opentelemetry-target-allocator-rhel9 1785704551 Red Hat Update Infrastructure 5 rhui5/cds-tp-rhel9 1787241206
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20
  • Red Hat Cost Management 4
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Insights proxy 1.5
  • Red Hat Red Hat OpenShift distributed tracing 3.10.1
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.