Medium severity · published Aug 8, 2025
CVE-2025-8736
GNU cflow Lexer c.c yylex buffer overflow
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
cflow · GNU
1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8736
drive.google.com
https://drive.google.com/file/d/17lkJ5bSiQZoXLTg3bK-rGBt3kahN9Xse/view?usp=drive_link
lists.gnu.org
https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00001.html
vuldb.com
https://vuldb.com/?ctiid.319232
vuldb.com
https://vuldb.com/?id.319232
vuldb.com
https://vuldb.com/?submit.622329
www.gnu.org
https://www.gnu.org/
More from cflow
7.5
CVE-2023-2789
A vulnerability was found in GNU cflow 1.7
6.5
CVE-2019-16166
GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c
6.5
CVE-2019-16165
GNU cflow through 1.6 has a use-after-free in the reference function in parser.c
5.5
CVE-2020-23856
Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointer variable…
3.3
CVE-2025-8735
GNU cflow Lexer c.c yylex null pointer dereference