Moderate Vulnerability in Coreutils: Heap Buffer Under-Read in GNU Coreutils Sort
Summary
ALSA-2026:69964: Moderate: coreutils security update. Affects coreutils versions < 8.30-21.el8_10. Fixed in 8.30-21.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Coreutils is a package that contains the GNU Core Utilities, which are essential for file manipulation, text processing, and system management in Unix-like operating systems. It combines functionalities from previously separate packages: GNU fileutils, sh-utils, and textutils. The coreutils package is widely used in various distributions, including AlmaLinux, and is crucial for system operations. However, it has been identified that certain versions of coreutils are vulnerable to a heap buffer under-read issue, which can potentially lead to data exposure or system instability.
Vulnerability Detail
The vulnerability identified as CVE-2025-5278 is a heap buffer under-read in the GNU Coreutils sort command, specifically related to key specification. This flaw allows an attacker to manipulate the input in such a way that it can read memory locations that it should not have access to, potentially exposing sensitive information. The ramifications of this vulnerability can include unauthorized data access and system compromise, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
8.30-21.el8_10
This is the first release that contains the fix.
sudo dnf update coreutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the sort command with key specifications until they have updated to the patched version. This can help mitigate the risk of exploitation until a full update can be applied.
Conclusion
The coreutils package has a moderate vulnerability (CVE-2025-5278) that can lead to heap buffer under-reads, posing risks to data security and system integrity. Users are strongly advised to update to the patched version (8.30-21.el8_10) to mitigate these risks. Temporary workarounds are available, but updating is the best course of action.
See every vulnerability recorded for coreutils →
FAQ
CVE-2025-5278 is a vulnerability in the GNU Coreutils sort command that allows for a heap buffer under-read, potentially leading to unauthorized data exposure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
The risks include unauthorized access to sensitive data and potential system instability, which could lead to further exploitation.
Yes, as a temporary measure, avoid using the sort command with key specifications until you can update to the patched version.
More information can be found on the CVE page linked in the advisory, which provides details on the impact, CVSS score, and acknowledgments.
Related vulnerabilities
Recent vulnerabilities recorded for coreutils.
