CVE-2025-48188

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48188
libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read.

2.9 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://savannah.gnu.org/bugs/?67079 Exploit Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:pspp:*:*:*:*:*:*:*:*
History

17 Jul 2025, 20:33

Type Values Removed Values Added
References () https://savannah.gnu.org/bugs/?67079 - () https://savannah.gnu.org/bugs/?67079 - Exploit, Issue Tracking
First Time Gnu
Gnu pspp
CPE cpe:2.3:a:gnu:pspp:*:*:*:*:*:*:*:*

19 May 2025, 13:35

Type Values Removed Values Added
Summary
  • (es) libpspp-core.a en GNU PSPP hasta 2.0.1 tiene una llamada incorrecta desde fill_buffer (en data/encrypted-file.c) a la función rijndaelDecrypt de Gnulib, lo que genera una sobrelectura del búfer basado en el montón.

16 May 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-16 21:15

Updated : 2025-07-17 20:33

NVD link : CVE-2025-48188

Mitre link : CVE-2025-48188

CVE.ORG link : CVE-2025-48188

JSON object : View

Products Affected

gnu

  • pspp
CWE
CWE-125

Out-of-bounds Read