Coreutils: heap buffer under-read in gnu coreutils sort via key specification
Priority LOW 20CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Partial Red Hat: 11 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix Partial coreutils: 9.8Red Hat: 19 advisoriesRed Hat: 11 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | coreutils | 7.2 to before 9.8 | 9.8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 9.5-8.el10_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8.30-21.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 8.32-41.el9_8 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791371080 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791371069 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791788287 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791970484 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459707 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459711 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459759 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1789029076 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791966259 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | 1790598593 | Patch available | CNA |
| Red Hat | Cost Management 4 | — | 1783539156 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 1782756541 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 1784821670 | Patch available | CNA |
| Red Hat | Red Hat Insights proxy 1.5 | — | 1782890503 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782501180 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782501200 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782498923 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782510941 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782501220 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782501196 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1782501195 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1785704636 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | 1785704547 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1784794818 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1784794778 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1784795112 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1784794289 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1784795076 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787241211 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787135742 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787241260 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
- coreutils Vendor— Affected 7.2 to before 9.8 Fixed in 9.8 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 9.5-8.el10_2 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8.30-21.el8_10 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 8.32-41.el9_8 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791371080 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791371069 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791788287 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791970484 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459707 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459711 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459759 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1789029076 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791966259 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.20 VendorRed Hat Affected — Fixed in 1790598593 Patch available CNA
- Cost Management 4 VendorRed Hat Affected — Fixed in 1783539156 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 1782756541 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 1784821670 Patch available CNA
- Red Hat Insights proxy 1.5 VendorRed Hat Affected — Fixed in 1782890503 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782501180 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782501200 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782498923 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782510941 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782501220 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782501196 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1782501195 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1785704636 Patch available CNA
- Red Hat OpenShift distributed tracing 3.10.1 VendorRed Hat Affected — Fixed in 1785704547 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1784794818 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1784794778 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1784795112 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1784794289 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1784795076 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787241211 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787135742 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787241260 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift AI (RHOAI) VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:enterprise_linux:10.2 | 10.2 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:8::baseos | 8 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:9::baseos | 9 | — | Red Hat |
| cpe:/a:redhat:cert_manager:1.17::el9 | 1.17 | — | Red Hat |
| cpe:/a:redhat:cert_manager:1.18::el9 | 1.18 | — | Red Hat |
| cpe:/a:redhat:cert_manager:1.20::el9 | 1.20 | — | Red Hat |
| cpe:/a:redhat:cost_management:4::el9 | 4 | — | Red Hat |
| cpe:/a:redhat:discovery:2::el9 | 2 | — | Red Hat |
| cpe:/a:redhat:insights_proxy:1.5::el9 | 1.5 | — | Red Hat |
| cpe:/a:redhat:openshift_distributed_tracing:3.10::el9 | 3.10 | — | Red Hat |
- cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
- cpe:/a:redhat:cert_manager:1.17::el9 Versions 1.17 — ·Red Hat
- cpe:/a:redhat:cert_manager:1.18::el9 Versions 1.18 — ·Red Hat
- cpe:/a:redhat:cert_manager:1.20::el9 Versions 1.20 — ·Red Hat
- cpe:/a:redhat:cost_management:4::el9 Versions 4 — ·Red Hat
- cpe:/a:redhat:discovery:2::el9 Versions 2 — ·Red Hat
- cpe:/a:redhat:insights_proxy:1.5::el9 Versions 1.5 — ·Red Hat
- cpe:/a:redhat:openshift_distributed_tracing:3.10::el9 Versions 3.10 — ·Red Hat
Remediation
- Fix · CNA coreutils Fixed in 9.8
Red Hat 19 advisories
- RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
- RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
- RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 16 more Red Hat advisories
- RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
- RHSA-2026:69964 Released 2026-09-22 · Red Hat rating Moderatecoreutils security update
- Red Hat Enterprise Linux BaseOS (v. 8) coreutils-8.30-21.el8_10, coreutils-single-8.30-21.el8_10
- RHSA-2026:58981 Released 2026-08-24 · Red Hat rating CriticalRed Hat Update Infrastructure 5.3 Technology Preview security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
- RHSA-2026:50205 Released 2026-08-04 · Red Hat rating ImportantRed Hat build of OpenTelemetry 3.10.1 release
- Red Hat OpenShift distributed tracing 3.10.1 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator
- RHSA-2026:46836 Released 2026-07-27 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:44481 Released 2026-07-23 · Red Hat rating ImportantRed Hat Update Infrastructure 5.2 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:39981 Released 2026-07-15 · Red Hat rating ImportantCost Management Metrics Operator Update
- Cost Management 4 registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator
- RHSA-2026:34102 Released 2026-07-01 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- RHSA-2026:33612 Released 2026-06-30 · Red Hat rating ModerateRed Hat OpenShift distributed tracing platform (Tempo) 3.10.1 release
- Red Hat OpenShift distributed tracing 3.10.1 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9, registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9 +4
- RHSA-2026:33313 Released 2026-06-29 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:33124 Released 2026-06-29 · Red Hat rating Moderatecoreutils security update
- Red Hat Enterprise Linux BaseOS (v. 10) coreutils-9.5-8.el10_2, coreutils-single-9.5-8.el10_2
- RHSA-2026:28911 Released 2026-06-24 · Red Hat rating Moderatecoreutils security update
- Red Hat Enterprise Linux BaseOS (v. 9) coreutils-8.32-41.el9_8, coreutils-single-8.32-41.el9_8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888 |
| Cert Manager support for Red Hat OpenShift release 1.18 | Fixed | RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857 |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72502 |
| Cost Management 4 | Fixed | RHSA-2026:39981 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:33313, RHSA-2026:46836 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:33124 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:69964 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:28911 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2026:34102 |
| Red Hat OpenShift distributed tracing 3.10.1 | Fixed | RHSA-2026:33612, RHSA-2026:50205 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:44481, RHSA-2026:58981 |
Not affected: 8 products
- Cost Management 4
- Red Hat Discovery 2
- Red Hat Enterprise Linux BaseOS (v. 10)
- Red Hat Enterprise Linux BaseOS (v. 8)
- Red Hat Enterprise Linux BaseOS (v. 9)
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift distributed tracing 3.10.1
- Red Hat Update Infrastructure 5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-5278
- 2026-10-03 Alias added: GHSA-ch64-4x3c-w3jq
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-14 Fix available: cert-manager/cert-manager-istio-csr-rhel9@1791459759, cert-manager/cert-manager-operator-rhel9@1789029076, cert-manager/cert-manager-operator-rhel9@1791788287 +4 · CNA
- 2026-10-14 5 new references · CNA
- 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
- 2026-10-15 Fix available: cert-manager/cert-manager-operator-bundle@1791966259, cert-manager/cert-manager-operator-bundle@1791970484 · CNA
- 2026-10-15 2 new references · CNA
- 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
- 2026-10-31 Affected versions changed · CNA
- 2026-10-31 Fix available: Red Hat OpenShift distributed tracing 3.10.1 · Red Hat
- 2026-11-06 Affected versions changed · CNA
- 2026-11-06 Affected versions changed · Red Hat
References
Advisory 19
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-5278 · CVE Program
- CVE-2025-5278 · NVD
- FIRST EPSS
- GHSA-ch64-4x3c-w3jq · GitHub Advisory Database · CC BY 4.0
- CVE-2025-5278 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences