GNU cflow Lexer c.c yylex null pointer dereference_CVE-2025-8735

4.8 / 10

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Description

A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Basic Information

ID CVE-2025-8735

Source VulDB

Published Aug 8, 2025 at 18:32

Modified Aug 8, 2025 at 18:45

Affected Product

Vendor GNU

Product cflow

Version 1.0

Affected Versions GNU cflow 1.0
GNU cflow 1.1
GNU cflow 1.2
GNU cflow 1.3
GNU cflow 1.4
GNU cflow 1.5
GNU cflow 1.6
GNU cflow 1.7
GNU cflow 1.8

CWE Classification

CWE-476 CWE-404

References

{
    "lastseen": "",
    "description": "A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.",
    "published": "2025-08-08T18:32:06.777Z",
    "modified": "2025-08-08T18:45:30.466Z",
    "type": "cve",
    "title": "GNU cflow Lexer c.c yylex null pointer dereference",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.319231\nhttps://vuldb.com/?ctiid.319231\nhttps://vuldb.com/?submit.622328\nhttps://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00000.html\nhttps://drive.google.com/file/d/1Q_rDQSEl3cBu6SUbfqr9pV9cHgvKcXFI/view?usp=drive_link\nhttps://www.gnu.org/",
    "id": "CVE-2025-8735",
    "bulletinFamily": "",
    "cwe": [
        "CWE-476",
        "CWE-404"
    ],
    "cvelist": null,
    "sourceData": "GNU cflow 1.0\nGNU cflow 1.1\nGNU cflow 1.2\nGNU cflow 1.3\nGNU cflow 1.4\nGNU cflow 1.5\nGNU cflow 1.6\nGNU cflow 1.7\nGNU cflow 1.8",
    "sourceHref": "",
    "cvss": {
        "score": 4.8,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "cflow",
    "version": "1.0",
    "vendor": "GNU",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}