Log in Start free

Vulnerability · Published Aug 8, 2025 · Assigned by VulDB

CVE-2025-8735GNU cflow Lexer c.c yylex null pointer dereference

Low 3.3

In plain English

A low-severity null pointer dereference in cflow from GNU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cflowno fix listedDEBIAN-CVE-2025-8735
Debian:13cflowno fix listedDEBIAN-CVE-2025-8735
Debian:14cflowno fix listedDEBIAN-CVE-2025-8735
Ubuntu:22.04:LTScflowno fix listedUBUNTU-CVE-2025-8735
Ubuntu:24.04:LTScflowno fix listedUBUNTU-CVE-2025-8735
Ubuntu:25.10cflowno fix listedUBUNTU-CVE-2025-8735
Ubuntu:26.04:LTScflowno fix listedUBUNTU-CVE-2025-8735
Ubuntu:26.10cflowno fix listedUBUNTU-CVE-2025-8735

Affected products (as reported)

VendorProductVersions
GNU cflow 1.01.11.21.31.41.51.61.7

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References