Moderate Security Vulnerability in Coreutils: Heap Buffer Under-Read in GNU Coreutils Sort
Summary
ALSA-2026:28911: Moderate: coreutils security update. Affects coreutils versions < 8.32-41.el9_8. Fixed in 8.32-41.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Coreutils is a package that contains the GNU Core Utilities, which are essential for basic file, shell, and text manipulation tasks in Unix-like operating systems. It combines functionalities from previously separate packages like GNU fileutils, sh-utils, and textutils. The coreutils package is widely used in various Linux distributions, including AlmaLinux, and is critical for system operations and scripting. The recent vulnerability identified poses a risk to the integrity and security of systems utilizing this package.
Vulnerability Detail
The vulnerability, identified as CVE-2025-5278, is a Heap Buffer Under-Read issue in the GNU Coreutils sort command, which can potentially allow an attacker to read sensitive data from memory. This flaw arises from improper handling of key specifications during sorting operations, which could lead to unintended data exposure. The ramifications of this vulnerability include the possibility of data leakage and unauthorized access to sensitive information, making it a moderate security concern.
How To Fix
Minimum fixed version
8.32-41.el9_8
This is the first release that contains the fix.
sudo dnf update coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the sort command with key specifications until the package is updated. This may limit some functionalities but will help mitigate the risk of exploitation until a fix is applied.
Conclusion
The coreutils package has a moderate security vulnerability (CVE-2025-5278) that can lead to data exposure through a Heap Buffer Under-Read in the sort command. Users are advised to update to the patched version to mitigate risks. For ongoing monitoring of vulnerabilities, consider using Vulert, which allows real-time alerts without needing code access.
See every vulnerability recorded for coreutils →
FAQ
CVE-2025-5278 is a vulnerability in the GNU Coreutils sort command that allows for a Heap Buffer Under-Read, potentially exposing sensitive data.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The risks include potential data leakage and unauthorized access to sensitive information, which can compromise system security.
Yes, a patch is available in version 8.32-41.el9_8 of the coreutils package. Updating to this version will resolve the issue.
If immediate updates are not possible, refrain from using the sort command with key specifications as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
