CVE-2025-47815

MEDIUM

GNU Pspp < 2.0.1 - Out-of-Bounds Write

Title source: rule

Description

libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in zip-reader.c.

References (1)

[Exploit] https://savannah.gnu.org/bugs/?67075

Scores

CVSS v3 4.5

EPSS 0.0023

EPSS Percentile 45.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Classification

CWE

CWE-122 CWE-787

Status published

Affected Products (1)

gnu/pspp < 2.0.1

Timeline

Published May 10, 2025

Tracked Since Feb 18, 2026