Segmentation Fault Vulnerability in gnuplot: CVE-2025-31179
Summary
UBUNTU-CVE-2025-31179: A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash. Affects gnuplot versions < 4.6.4-2ubuntu0.1~esm2. Fixed in 4.6.4-2ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gnuplot is a portable command-line driven graphing utility that allows users to visualize data in various formats. It is widely used for plotting mathematical functions and data points, providing a range of features including 2D and 3D plotting capabilities. The vulnerability identified as CVE-2025-31179 affects multiple versions of gnuplot, potentially leading to system crashes due to a flaw in the xstrftime() function.
Vulnerability Detail
A flaw was found in gnuplot's xstrftime() function, which may lead to a segmentation fault, causing a system crash. This vulnerability arises from improper handling of certain inputs, which can result in unexpected behavior and instability of the application. The CVSS score for this vulnerability is 6.2, indicating a medium severity level, and it could be exploited by an attacker to disrupt service availability.
How To Fix
Minimum fixed version
4.6.4-2ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnuplotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the xstrftime() function in their scripts until the package is updated. Additionally, running gnuplot in a controlled environment or using alternative plotting tools may help mitigate the risk.
Conclusion
The vulnerability CVE-2025-31179 in gnuplot poses a risk of segmentation faults that can lead to system crashes. Users are advised to update their gnuplot installations to the latest patched versions to ensure system stability and security. Monitoring tools like Vulert can help keep track of vulnerabilities in your software.
See every vulnerability recorded for gnuplot →
FAQ
CVE-2025-31179 is a vulnerability in gnuplot that can cause a segmentation fault, leading to a system crash.
You can check your version of gnuplot by running 'gnuplot --version' in your terminal. Compare it with the affected versions listed in the vulnerability report.
Yes, a patched version of gnuplot is available. Users should update to the latest version to mitigate the vulnerability.
The vulnerability can lead to application crashes, resulting in service disruptions and potential data loss.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for gnuplot.
