GNU Cflow vulnerabilities

6 CVEs affecting GNU Cflow, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-8736, published 2025-08-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-2789, published 2023-05-18. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_declaration of the file parser.c. The manipulation leads to…
CVE-2019-16165, published 2019-09-09. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.
CVE-2019-16166, published 2019-09-09. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.
CVE-2020-23856, published 2021-05-18. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointer variable caller->callee.
CVE-2025-8736, published 2025-08-08. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads…
CVE-2025-8735, published 2025-08-08. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null…