Critical Memory Handling Vulnerabilities in Gnuplot: Denial of Service and Code Execution Risks
Summary
USN-7773-1: gnuplot vulnerabilities. Affects gnuplot versions < 4.6.4-2ubuntu0.1~esm2. Fixed in 4.6.4-2ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gnuplot is a widely used open-source plotting utility that enables users to create graphs and visualizations from data. It supports various output formats and is utilized in scientific and engineering applications. However, recent vulnerabilities have been discovered that compromise its memory handling, potentially allowing attackers to exploit these weaknesses.
Vulnerability Detail
ChenYiFan Liu discovered multiple vulnerabilities in Gnuplot related to improper memory operations. These vulnerabilities could lead to denial of service attacks or even arbitrary code execution. Specifically, CVE-2025-31176 and CVE-2025-31180 affect Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 25.04. The vulnerabilities stem from inadequate handling of memory, which could be exploited by an attacker to manipulate the application’s behavior.
How To Fix
Minimum fixed version
4.6.4-2ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnuplotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of Gnuplot in sensitive environments until the updates are applied. Avoid using Gnuplot for critical applications where data integrity and security are paramount.
Conclusion
The recent vulnerabilities in Gnuplot pose significant risks, including denial of service and potential arbitrary code execution. It is crucial for users to update their installations to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for gnuplot →
FAQ
The vulnerabilities primarily involve improper memory handling, which could lead to denial of service or arbitrary code execution.
The vulnerabilities affect Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 25.04.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
As a temporary measure, limit the use of Gnuplot in critical environments and avoid processing sensitive data until the vulnerabilities are patched.
Detailed information about the vulnerabilities can be found in the Ubuntu Security Notices and the CVE records associated with Gnuplot.
Related vulnerabilities
Recent vulnerabilities recorded for gnuplot.
