# CVE-2025-5278: GNU Coreutils heap buffer under-read in sort utility

Source: https://junglewise.ai/threats/cve-2025-5278-gnu-coreutils-heap-buffer-under-read-in-sort-utility  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-27. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-5278 · Severity: medium · CVSS 4.4 · Published 2025-05-27

A vulnerability was found in the GNU Coreutils 'sort' utility, a standard tool used in Linux and Unix-like systems for organizing data. By providing a specially crafted command-line argument using an older formatting style, an attacker could cause the program to crash or potentially reveal small amounts of sensitive information from the computer's memory. This issue primarily affects systems where automated scripts or users process untrusted command-line parameters.

Technologies: [Gnu Coreutils](https://junglewise.ai/threats/technologies/coreutils). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2025-5278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5278 being exploited in the wild.

**How severe is CVE-2025-5278?** Medium severity, with a CVSS score of 4.4, published 27 May 2025.

**Which products and versions are affected?** Gnu Coreutils 7.2 through current (pre-fix) versions.

**Is there a fix for CVE-2025-5278?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-5278 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-5278?** Check whether you run Gnu Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer under-read exists in the begfield() function within GNU Coreutils 'sort' utility (src/sort.c). The flaw is caused by unsafe pointer arithmetic when parsing traditional key specifications (e.g., +POS1.C1). Specifically, providing a character position value of UINTMAX_MAX (18446744073709551615 on 64-bit systems) triggers an integer wraparound during the 'ptr + schar' calculation. This results in a pointer that points one byte before the start of the allocated heap buffer. When this invalid pointer is subsequently used in functions like compare_random() or strxfrm(), it triggers an out-of-bounds read. The vulnerability was introduced in version 7.2 and has been addressed in the latest source commits.

## Affected products

- GNU Coreutils 7.2 through current (pre-fix) versions

## Timeline

- 2025-05-20: disclosed: Vulnerability reported to GNU Coreutils maintainers by Med Maatallah.
- 2025-05-27: advisory: Public disclosure and CVE assignment.

## References

- [https://access.redhat.com/security/cve/CVE-2025-5278](https://access.redhat.com/security/cve/CVE-2025-5278)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2368764](https://bugzilla.redhat.com/show_bug.cgi?id=2368764)
- [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633](https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633)
- [https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507)
- [http://www.openwall.com/lists/oss-security/2025/05/27/2](http://www.openwall.com/lists/oss-security/2025/05/27/2)
- [http://www.openwall.com/lists/oss-security/2025/05/29/1](http://www.openwall.com/lists/oss-security/2025/05/29/1)
- [http://www.openwall.com/lists/oss-security/2025/05/29/2](http://www.openwall.com/lists/oss-security/2025/05/29/2)

## Related threats

- [GNU coreutils heap buffer overflow in unexpand](https://junglewise.ai/threats/cve-2026-56392-gnu-coreutils-heap-buffer-overflow-in-unexpand)
- [GNU coreutils out-of-bounds read in uniq](https://junglewise.ai/threats/cve-2026-56391-gnu-coreutils-out-of-bounds-read-in-uniq)