CVE-2025-5898 in PSPP
Summary
by MITRE • 06/10/2025
A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to out-of-bounds write. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/25/2026
The vulnerability identified in GNU PSPP represents a critical out-of-bounds write flaw within the parse_variables_option function of the utilities/pspp-convert.c file. This issue arises from insufficient input validation and boundary checking during the processing of variable options, creating a scenario where maliciously crafted input can cause the application to write data beyond the allocated memory boundaries. The vulnerability is particularly concerning as it affects a core conversion utility within the statistical software suite, potentially enabling attackers to corrupt memory structures and compromise system integrity.
The technical implementation of this flaw demonstrates poor memory management practices where the function fails to properly validate array indices or buffer limits when processing user-supplied parameters. This type of vulnerability falls under CWE-787 Out-of-bounds Write, which is classified as a critical weakness in software security frameworks. The attack vector requires local access to the system, meaning an attacker must already have login privileges or physical access to manipulate the application. However, this local requirement does not diminish the severity of the flaw, as it can enable privilege escalation attacks or serve as a foothold for more sophisticated exploitation techniques.
From an operational perspective, this vulnerability poses significant risks to users who employ GNU PSPP for data analysis and statistical processing. The out-of-bounds write condition could lead to application crashes, data corruption, or potentially allow attackers with local access to execute arbitrary code within the context of the running process. The disclosure of exploit details increases the likelihood of real-world exploitation, particularly in environments where users might inadvertently process maliciously crafted data files. Security practitioners should consider this vulnerability as a high-priority issue requiring immediate attention and remediation.
Mitigation strategies for this vulnerability should include immediate patching of the GNU PSPP software to the latest stable release containing the fix for the out-of-bounds write condition. System administrators should also implement additional security controls such as privilege separation, input validation at multiple layers, and monitoring for unusual application behavior that might indicate exploitation attempts. The ATT&CK framework categorizes this type of vulnerability under T1059 Command and Scripting Interpreter and T1068 Exploitation for Privilege Escalation, highlighting the potential for attackers to leverage such flaws for system compromise. Organizations should also consider network segmentation and access controls to limit local system access where possible, reducing the attack surface for this class of vulnerability.