CVE-2025-8734

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8734
A vulnerability has been found in GNU Bison up to 3.8.2. This impacts the function code_free of the file src/scan-code.c. The manipulation leads to double free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The actual existence of this vulnerability is currently in question. The issue could not be reproduced from a GNU Bison 3.8.2 tarball run in a Fedora 42 container.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

1.7 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://drive.google.com/file/d/123Qe44FaC-GP88dWNl9-6H4jLWUcXYNZ/view?usp=drive_link
https://github.com/akimd/bison/issues/115
https://vuldb.com/?ctiid.319230
https://vuldb.com/?id.319230
https://vuldb.com/?submit.622300
https://www.gnu.org/
https://www.openwall.com/lists/oss-security/2025/10/27/12
Configurations

No configuration.

History

28 Oct 2025, 01:16

Type Values Removed Values Added
References
  • () https://www.openwall.com/lists/oss-security/2025/10/27/12 -

19 Aug 2025, 05:15

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad clasificada como problemática en GNU Bison hasta la versión 3.8.2. La función code_free del archivo src/scan-code.c se ve afectada. La manipulación provoca una doble liberación. El ataque debe abordarse localmente. Se ha hecho público el exploit y puede que sea utilizado.
Summary (en) A vulnerability classified as problematic has been found in GNU Bison up to 3.8.2. Affected is the function code_free of the file src/scan-code.c. The manipulation leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. (en) A vulnerability has been found in GNU Bison up to 3.8.2. This impacts the function code_free of the file src/scan-code.c. The manipulation leads to double free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The actual existence of this vulnerability is currently in question. The issue could not be reproduced from a GNU Bison 3.8.2 tarball run in a Fedora 42 container.

08 Aug 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-08 18:15

Updated : 2025-10-28 01:16

NVD link : CVE-2025-8734

Mitre link : CVE-2025-8734

CVE.ORG link : CVE-2025-8734

JSON object : View

Products Affected

No product.

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-415

Double Free