Low severity · published Aug 8, 2025
CVE-2025-8735
GNU cflow Lexer c.c yylex null pointer dereference
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
cflow · GNU
1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8735
drive.google.com
https://drive.google.com/file/d/1Q_rDQSEl3cBu6SUbfqr9pV9cHgvKcXFI/view?usp=drive_link
lists.gnu.org
https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00000.html
vuldb.com
https://vuldb.com/?ctiid.319231
vuldb.com
https://vuldb.com/?id.319231
vuldb.com
https://vuldb.com/?submit.622328
www.gnu.org
https://www.gnu.org/
More from cflow
7.5
CVE-2023-2789
A vulnerability was found in GNU cflow 1.7
6.5
CVE-2019-16166
GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c
6.5
CVE-2019-16165
GNU cflow through 1.6 has a use-after-free in the reference function in parser.c
5.5
CVE-2020-23856
Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointer variable…
5.3
CVE-2025-8736
GNU cflow Lexer c.c yylex buffer overflow