CVE-2025-5899
GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jun 9, 2025
- Updated
- Jun 10, 2025
- Reserved
- Jun 9, 2025
Description
A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-590 Free of Memory not on the Heap
Affected Products
| Product | Versions |
|---|---|
PSPPGNU |
|
References
- VDB-311671 | GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heapvdb-entrytechnical-description
- VDB-311671 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #586106 | GNU libpspp pspp-convert master in Git Repository[commit:82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb] Denial of Servicethird-party-advisory
- https://savannah.gnu.org/bugs/index.php?67072related
- https://drive.google.com/file/d/1YPJLiBzOwVTcc2FzdawYxBJWGujwqy7o/view?usp=sharingexploit
- https://www.gnu.org/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.