CVE-2025-8736 | THREATINT

Description

A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Eine kritische Schwachstelle wurde in GNU cflow bis 1.8 entdeckt. Dies betrifft die Funktion yylex der Datei c.c der Komponente Lexer. Dank Manipulation mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur öffentlichen Verfügung.

Reserved 2025-08-08 | Published 2025-08-08 | Updated 2025-08-08 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

MEDIUM: 5.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

4.3AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Buffer Overflow

Memory Corruption

Product status

1.0

affected

1.1

affected

1.2

affected

1.3

affected

1.4

affected

1.5

affected

1.6

affected

1.7

affected

1.8

affected

Timeline

2025-08-08:	Advisory disclosed
2025-08-08:	VulDB entry created
2025-08-08:	VulDB entry last update

References

vuldb.com/?id.319232 (VDB-319232 | GNU cflow Lexer c.c yylex buffer overflow) vdb-entry technical-description

vuldb.com/?ctiid.319232 (VDB-319232 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.622329 (Submit #622329 | GNU cflow cflow cflow (GNU cflow) the newest master (0a19319e282506ff88d19e630380cd5069e893ed ) in cflow.git - GNU cflow Buffer Overflow) third-party-advisory

lists.gnu.org/archive/html/bug-cflow/2025-07/msg00001.html related

drive.google.com/...LTg3bK-rGBt3kahN9Xse/view?usp=drive_link exploit

www.gnu.org/ product

cve.org (CVE-2025-8736)

nvd.nist.gov (CVE-2025-8736)

Download JSON