CVE-2025-5899

CWE-5907 documents7 sources
Severity
4.8MEDIUM
EPSS
0.1%
top 78.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Pspp
Timeline
PublishedJun 9
Latest updateApr 7

Description

A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5gnu/pspp82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb

🔴Vulnerability Details

3
GHSA
GHSA-65vc-89h4-wvx6: A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb↗2025-06-10
▶
OSV
CVE-2025-5899: A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb↗2025-06-09
▶
CVEList
GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap↗2025-06-09
▶

📋Vendor Advisories

2
Chrome
Stable Channel Update for Desktop: CVE-2026-5897↗2026-04-07
▶
Debian
CVE-2025-5899: pspp - A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7a...↗2025
▶

💬Community

1
Bugzilla
CVE-2025-5899 pspp: GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap [fedora-42]↗2025-06-10
▶