CVE-2024-0684
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
Risk Assessment
The vulnerability can be exploited to remotely crash the application, causing a denial of service. Organizations using GNU coreutils in critical scripts that process user input are at risk of denial of service.
Recommendation
Update the GNU coreutils package to the latest version containing the fix. Avoid processing untrusted input through the split program until the update is applied.
Other vulnerabilities in GNU coreutils
See all- CVE-2014-9471High
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string.
- CVE-2026-56392Medium
In GNU coreutils unexpand, a heap-based buffer overflow occurs due to an integer overflow during buffer allocation when processing large -t values. This can lead to out-of-bounds heap write and potentially achieve a heap write primitive.
- CVE-2026-56391Medium
In the GNU coreutils uniq utility, an out-of-bounds read vulnerability exists due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates byte length by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input, leading to a crash and potential adjacent heap memory exposure.
- CVE-2025-5278Medium
In GNU Coreutils, the begfield() function in the sort utility is vulnerable to a heap buffer under-read. A crafted command using the traditional key format may access memory outside the allocated buffer.
Original NVD description (English source)
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS