Moderate Vulnerability in Coreutils: Heap Buffer Under-Read in Sort Function
Summary
RLSA-2026:33124: Moderate: coreutils security update. Affects coreutils versions < 0:9.5-8.el10_2. Fixed in 0:9.5-8.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Coreutils is a package that includes the GNU Core Utilities, which are essential for basic file, shell, and text manipulation tasks in Unix-like operating systems. It combines functionalities from previously separate packages: GNU fileutils, sh-utils, and textutils. Given its fundamental role in system operations, any vulnerabilities in Coreutils can have significant implications for system security and stability.
Vulnerability Detail
The vulnerability identified as CVE-2025-5278 is a Heap Buffer Under-Read in the sort function of GNU Coreutils. This flaw allows an attacker to exploit the sort command by manipulating key specifications, potentially leading to unauthorized access to sensitive data or system instability. The ramifications of this vulnerability can range from data leakage to denial of service, depending on how the affected system is utilized.
How To Fix
Minimum fixed version
0:9.5-8.el10_2
This is the first release that contains the fix.
sudo dnf update coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the sort command with manipulated key specifications until the package can be updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The vulnerability CVE-2025-5278 in the Coreutils package poses a moderate risk due to a Heap Buffer Under-Read in the sort function. Users are encouraged to update their Coreutils package to the latest patched version to mitigate this risk and ensure system security.
See every vulnerability recorded for coreutils →
FAQ
CVE-2025-5278 is a vulnerability in the GNU Coreutils package that involves a Heap Buffer Under-Read in the sort function.
This vulnerability can lead to unauthorized access to sensitive data or system instability, depending on how the sort command is used.
The CVSS score for this vulnerability is 4.4, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using the sort command with manipulated key specifications as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
