coreutils: A flaw was found in GNU Coreutils
CVE-2025-5278 is fixed in 8 products on 1 platform, first by RHSA-2026:33124, released May 27, 2025. It is not reported as exploited. Patch Radar priority: Routine.
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| coreutils · RHEL 10 | 9.5-8.el10_2 | RHSA-2026:33124 | May 27, 2025 |
| coreutils · RHEL 8 | 0:8.30-21.el8_10 | RHSA-2026:69964 | Sep 23, 2026 |
| coreutils · RHEL 9 | 0:8.32-41.el9_8 | RHSA-2026:28911 | Jun 29, 2026 |
| coreutils · Ubuntu 22.04.1 LTS (jammy) | 8.32-4.1ubuntu1.4 | coreutils 8.32-4.1ubuntu1.4 | May 27, 2025 |
| coreutils · Ubuntu 24.04.5 LTS (noble) | 9.4-3ubuntu6.3 | coreutils 9.4-3ubuntu6.3 | May 27, 2025 |
| coreutils · almalinux 10 | 9.5-8.el10_2 | ALSA-2026:33124 | Jun 29, 2026 |
| coreutils · almalinux 8 | 8.30-21.el8_10 | ALSA-2026:69964 | Sep 22, 2026 |
| coreutils · almalinux 9 | 8.32-41.el9_8 | ALSA-2026:28911 | Jun 24, 2026 |
| coreutils · amzn 2023 | 8.32-30.amzn2023.0.4 | ALAS2023-2025-1194 | Sep 15, 2025 |
| coreutils · ol 10 | 0:9.5-8.0.1.el10_2 | ELSA-2026-33124 | Jul 16, 2026 |
| coreutils · ol 8 | 0:8.30-21.0.1.el8_10 | ELSA-2026-69964 | Sep 23, 2026 |
| coreutils · ol 9 | 0:8.32-41.0.1.el9_8 | ELSA-2026-28911 | Jun 25, 2026 |
| coreutils · opensuse-leap 15.6 | 8.32-150400.9.9.1 | SUSE-SU-2025:02362-1 | Jul 18, 2025 |
| coreutils · rocky 10 | 0:9.5-8.el10_2 | RLSA-2026:33124 | Jul 5, 2026 |
| coreutils · rocky 8 | 0:8.30-21.el8_10 | RLSA-2026:69964 | Sep 23, 2026 |
| coreutils · rocky 9 | 0:8.32-41.el9_8 | RLSA-2026:28911 | Jun 25, 2026 |
| coreutils · sles 15.6 | 8.32-150400.9.9.1 | SUSE-SU-2025:02362-1 | Jul 18, 2025 |
| coreutils · sles 15.7 | 8.32-150400.9.9.1 | SUSE-SU-2025:02362-1 | Jul 18, 2025 |
| coreutils-common · almalinux 10 | 9.5-8.el10_2 | ALSA-2026:33124 | Jun 29, 2026 |
| coreutils-common · almalinux 8 | 8.30-21.el8_10 | ALSA-2026:69964 | Sep 22, 2026 |
| coreutils-common · almalinux 9 | 8.32-41.el9_8 | ALSA-2026:28911 | Jun 24, 2026 |
| coreutils-common · amzn 2023 | 8.32-30.amzn2023.0.4 | ALAS2023-2025-1194 | Sep 15, 2025 |
| coreutils-common · ol 10 | 0:9.5-8.0.1.el10_2 | ELSA-2026-33124 | Jul 16, 2026 |
| coreutils-common · ol 8 | 0:8.30-21.0.1.el8_10 | ELSA-2026-69964 | Sep 23, 2026 |
| coreutils-common · ol 9 | 0:8.32-41.0.1.el9_8 | ELSA-2026-28911 | Jun 25, 2026 |
| coreutils-debuginfo · amzn 2023 | 8.32-30.amzn2023.0.4 | ALAS2023-2025-1194 | Sep 15, 2025 |
| coreutils-debugsource · amzn 2023 | 8.32-30.amzn2023.0.4 | ALAS2023-2025-1194 | Sep 15, 2025 |
| coreutils-single · RHEL 8 | 0:8.30-21.el8_10 | RHSA-2026:69964 | Sep 23, 2026 |
| coreutils-single · RHEL 9 | 0:8.32-41.el9_8 | RHSA-2026:28911 | Jun 29, 2026 |
| coreutils-single · almalinux 10 | 9.5-8.el10_2 | ALSA-2026:33124 | Jun 29, 2026 |
| coreutils-single · almalinux 8 | 8.30-21.el8_10 | ALSA-2026:69964 | Sep 22, 2026 |
| coreutils-single · almalinux 9 | 8.32-41.el9_8 | ALSA-2026:28911 | Jun 24, 2026 |
| coreutils-single · amzn 2023 | 8.32-30.amzn2023.0.4 | ALAS2023-2025-1194 | Sep 15, 2025 |
| coreutils-single · ol 10 | 0:9.5-8.0.1.el10_2 | ELSA-2026-33124 | Jul 16, 2026 |
| coreutils-single · ol 8 | 0:8.30-21.0.1.el8_10 | ELSA-2026-69964 | Sep 23, 2026 |
| coreutils-single · ol 9 | 0:8.32-41.0.1.el9_8 | ELSA-2026-28911 | Jun 25, 2026 |
| coreutils-single · opensuse-leap 15.6 | 8.32-150400.9.9.1 | SUSE-SU-2025:02362-1 | Jul 18, 2025 |
| coreutils-single-debuginfo · amzn 2023 | 8.32-30.amzn2023.0.4 | ALAS2023-2025-1194 | Sep 15, 2025 |
| coreutils-testsuite · opensuse-leap 15.6 | 8.32-150400.9.9.1 | SUSE-SU-2025:02362-1 | Jul 18, 2025 |
| gnu-coreutils · Ubuntu 26.04.1 LTS (resolute) | 9.7-3ubuntu2.1 | gnu-coreutils 9.7-3ubuntu2.1 | Jul 24, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.