CVE-2025-8736
published 2025-08-08CVE-2025-8736: A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the…
PriorityP429medium5.3CVSS 3.1
AVLACLPRLUINSUCLILAL
EPSS
0.16%
5.6th percentile
A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
| gnu | cflow | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.04.3MEDIUMAV:L/AC:L/Au:S/C:P/I:P/A:P
osv4.8MEDIUM
vendor_debian4.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-8736: A vulnerability, which was classified as critical, has been found in GNU cflow up to 1
osv·2025-08-08·CVSS 4.8
CVE-2025-8736 [MEDIUM] CVE-2025-8736: A vulnerability, which was classified as critical, has been found in GNU cflow up to 1
A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
GHSA
GHSA-c6jh-8mvm-v593: A vulnerability, which was classified as critical, has been found in GNU cflow up to 1
ghsa_unreviewed·2025-08-08
CVE-2025-8736 [MEDIUM] CWE-119 GHSA-c6jh-8mvm-v593: A vulnerability, which was classified as critical, has been found in GNU cflow up to 1
A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Debian
CVE-2025-8736: cflow - A vulnerability, which was classified as critical, has been found in GNU cflow u...
vendor_debian·2025·CVSS 4.8
CVE-2025-8736 [MEDIUM] CVE-2025-8736: cflow - A vulnerability, which was classified as critical, has been found in GNU cflow u...
A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
2025-08-08
Published