GNU Coreutils vulnerabilities

12 CVEs affecting GNU Coreutils, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56392, published 2026-07-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9471, published 2015-01-16. High severity, CVSS 7.5. EPSS: 7.1% chance of exploitation in the next 30 days. The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the…
CVE-2015-4042, published 2020-01-24. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified…
CVE-2015-4041, published 2020-01-24. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters,…
CVE-2024-0684, published 2024-02-06. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially…
CVE-2016-2781, published 2017-02-07. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
CVE-2009-4135, published 2009-12-11. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.
CVE-2017-18018, published 2018-01-04. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify…
CVE-2008-1946, published 2008-07-28. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command…
CVE-2005-1039, published 2005-05-02. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Race condition in Core Utilities (coreutils) 5.2.1, when (1) mkdir, (2) mknod, or (3) mkfifo is running with the -m switch, allows local users to modify permissions of other files.
CVE-2015-1865, published 2017-09-20. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. fts.c in coreutils 8.4 allows local users to delete arbitrary files.

Latest

CVE-2026-56392, published 2026-07-24. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to…
CVE-2026-56391, published 2026-07-24. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte…