CVE-2025-31177
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Gnuplot is affected by a heap buffer overflow at function utf8_copy_one.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, compromising system confidentiality and availability.
Recommendation
It is recommended to immediately update Gnuplot to the latest version that includes a fix for CVE-2025-31177.
Other vulnerabilities in Gnuplot
See all- CVE-2017-9670High
CVE-2017-9670 describes an uninitialized stack variable vulnerability in the load_tic_series() function in set.c in gnuplot 5.2.rc1. An attacker can cause Denial of Service (segmentation fault and memory corruption) or possibly have unspecified other impacts when a victim opens a specially crafted file.
- CVE-2025-31181Medium
A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.
- CVE-2025-31180Medium
A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.
- CVE-2025-31179Medium
A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.
- CVE-2025-31178Medium
A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.
- CVE-2025-31176Medium
A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.
- CVE-1999-0409Medium
Buffer overflow in gnuplot in Linux version 3.5 allows local users to obtain root access.
Original NVD description (English source)
gnuplot is affected by a heap buffer overflow at function utf8_copy_one.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS