Double Free Vulnerability in GNU Bison Package
Summary
DEBIAN-CVE-2025-8734: A vulnerability has been found in GNU Bison up to 3.8.2. Affects bison versions 2:3.7.5+dfsg-1 – 2:3.8.2+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Bison is a parser generator that is part of the GNU Project. It is used to convert a formal grammar description into a C program that parses that grammar. Bison is widely utilized in various software projects for its ability to generate parsers for different programming languages. The vulnerability in question affects Bison versions up to 3.8.2, specifically impacting the function code_free in the file src/scan-code.c, which can lead to potential security risks if exploited.
Vulnerability Detail
A vulnerability has been identified in GNU Bison up to version 3.8.2, where a double free condition occurs in the function code_free of src/scan-code.c. This vulnerability can be exploited locally, allowing an attacker to manipulate memory management, potentially leading to arbitrary code execution or crashes. Although the exploit has been publicly disclosed, the actual existence of this vulnerability is currently under scrutiny, as it could not be reproduced from a GNU Bison 3.8.2 tarball run in a Fedora 42 container.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid running the vulnerable version of Bison or restrict access to the system to prevent local exploitation until a patch is applied.
Conclusion
The double free vulnerability in GNU Bison poses a significant risk to systems using affected versions. Users are strongly encouraged to update to the latest version to mitigate potential security threats. Utilizing tools like Vulert can enhance monitoring and alerting for such vulnerabilities in open-source software.
See every vulnerability recorded for bison →
FAQ
The double free vulnerability can lead to memory corruption, which may allow an attacker to execute arbitrary code or crash the application.
You can check your version of Bison by running 'bison --version' in your terminal. If it is 3.8.2 or lower, it is affected by this vulnerability.
Yes, users are advised to update to the latest version of Bison where the vulnerability has been addressed.
Yes, Vulert can monitor your software for open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for bison.
