Description
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
References10
- access.redhat.com/errata/RHSA-2026:28911
- access.redhat.com/errata/RHSA-2026:33124
- access.redhat.com/errata/RHSA-2026:33313
- access.redhat.com/errata/RHSA-2026:33612
- access.redhat.com/errata/RHSA-2026:34102
- access.redhat.com/errata/RHSA-2026:39981
- access.redhat.com/errata/RHSA-2026:44481
- access.redhat.com/errata/RHSA-2026:46836
- access.redhat.com/errata/RHSA-2026:50205
- access.redhat.com/errata/RHSA-2026:58981
Metrics
- CVSS 3.1
-
4.4
MEDIUM
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - EPSS — exploit probability
- 0% percentile: 24 · as of 7 November 2026
- CWE
- CWE-121
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.