Segmentation Fault Vulnerability in gnuplot Package
Summary
UBUNTU-CVE-2025-31176: A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash. Affects gnuplot versions < 5.2.2+dfsg1-2ubuntu1+esm2. Fixed in 5.2.2+dfsg1-2ubuntu1+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gnuplot is a portable command-line driven graphing utility that allows users to visualize data in various formats. It is widely used in scientific and engineering applications for plotting functions and data points. The package supports multiple output formats, including interactive graphical interfaces and image files. However, a recent vulnerability has been identified that could lead to system crashes when using specific functions within gnuplot.
Vulnerability Detail
A flaw was found in gnuplot's plot3d_points() function, which may lead to a segmentation fault, causing a system crash. This vulnerability arises from improper handling of input data, which can result in unexpected behavior during execution. If exploited, it could lead to denial of service, impacting the availability of the system running the affected version of gnuplot. The CVSS score for this vulnerability is 6.2, indicating a medium severity level.
How To Fix
Minimum fixed version
5.2.2+dfsg1-2ubuntu1+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnuplotTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the plot3d_points() function until the package is updated. Additionally, consider running gnuplot in a controlled environment where potential crashes can be managed without affecting critical systems.
Conclusion
In summary, a segmentation fault vulnerability has been identified in the gnuplot package, specifically in the plot3d_points() function. Users are advised to update their gnuplot installations to mitigate the risk of system crashes. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gnuplot →
FAQ
gnuplot is a command-line driven graphing utility that allows users to visualize data in various formats, commonly used in scientific and engineering applications.
The vulnerability allows for a segmentation fault in the plot3d_points() function, which can lead to a system crash.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.2, indicating a medium severity level.
You can fix this vulnerability by updating gnuplot to the latest patched version using the command: sudo apt update && sudo apt install gnuplot.
Related vulnerabilities
Recent vulnerabilities recorded for gnuplot.
