CVE-2025-5278

MEDIUM

Published May 27, 2025

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Llama Stack	pip	—	No patch
8.4K14 dependentsPushed 5d ago22% patched~0d to patchFull package profile →
cert-manager/cert-manager-istio-csr-rhel9	—	—	No patch
cert-manager/cert-manager-operator-bundle	—	—	No patch
cert-manager/cert-manager-operator-rhel9	—	—	No patch
cert-manager/cert-manager-trust-manager-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-acmesolver-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-rhel9	—	—	No patch
coreutils	—	—	No patch
costmanagement/costmanagement-metrics-rhel9-operator	—	—	No patch
discovery/discovery-server-rhel9	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
insights-proxy/insights-proxy-container-rhel9	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
rhosdt/opentelemetry-collector-rhel9	—	—	No patch
rhosdt/opentelemetry-rhel9-operator	—	—	No patch
rhosdt/tempo-gateway-opa-rhel9	—	—	No patch
rhosdt/tempo-gateway-rhel9	—	—	No patch
rhosdt/tempo-jaeger-query-rhel9	—	—	No patch
rhosdt/tempo-operator-bundle	—	—	No patch
rhosdt/tempo-query-rhel9	—	—	No patch
rhosdt/tempo-rhel9	—	—	No patch
rhosdt/tempo-rhel9-operator	—	—	No patch
rhui5/cds-kubernetes-rhel9	—	—	No patch
rhui5/cds-kubernetes-tp-rhel9	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/installer-tp-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch
rhui5/rhua-tp-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CLow

INone

ALow

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2025-5278?

Is CVE-2025-5278 actively exploited?

No confirmed active exploitation of CVE-2025-5278 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-5278?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2025-5278?

CVE-2025-5278 has a CVSS v3.1 base score of 4.4 (MEDIUM).

What are the technical details?

Original Advisory

Weaknesses (CWE)

CWE-121Stack-based Buffer Overflow

CWE-121 — Stack-based Buffer Overflow: The product writes past the end of a buffer that was allocated on the stack.

[Operation, Build and Compilation] Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
[Architecture and Design] Use an abstraction library to abstract away risky APIs. Not a complete solution.

Source: MITRE CWE corpus.