CVE-2025-8735 - GNU cflow Lexer c.c yylex null pointer dereference

Back Back to CVE browser

MEDIUM

GNU cflow Lexer c.c yylex null pointer dereference

Published Aug 8, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.15%

Description

A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Affected products

Vendor GNU Product Cflow Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
- Version
  1.1
  Status
  affected
  Constraints
  -
- Version
  1.2
  Status
  affected
  Constraints
  -
- Version
  1.3
  Status
  affected
  Constraints
  -
- Version
  1.4
  Status
  affected
  Constraints
  -
- Version
  1.5
  Status
  affected
  Constraints
  -
- Version
  1.6
  Status
  affected
  Constraints
  -
- Version
  1.7
  Status
  affected
  Constraints
  -
- Version
  1.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GNU

Cflow

n/a

Version	Status	Constraints
1.0	affected	-
1.1	affected	-
1.2	affected	-
1.3	affected	-
1.4	affected	-
1.5	affected	-
1.6	affected	-
1.7	affected	-
1.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-404

Improper Resource Shutdown or Release

CWE-476

NULL Pointer Dereference

References (8)

https://drive.google.com/file/d/1Q_rDQSEl3cBu6SUbfqr9pV9cHgvKcXFI/view?usp=drive_link
exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24014
Advisory
https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00000.html
related
https://vuldb.com/?ctiid.319231
signaturepermissions-required
https://vuldb.com/?id.319231
vdb-entrytechnical-description
https://vuldb.com/?submit.622328
third-party-advisory
https://www.gnu.org/
product
https://www.openwall.com/lists/oss-security/2025/10/27/12

Link	Providers	Tags
https://drive.google.com/file/d/1Q_rDQSEl3cBu6SUbfqr9pV9cHgvKcXFI/view?usp=drive_link		exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24014		Advisory
https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00000.html		related
https://vuldb.com/?ctiid.319231		signaturepermissions-required
https://vuldb.com/?id.319231		vdb-entrytechnical-description
https://vuldb.com/?submit.622328		third-party-advisory
https://www.gnu.org/		product
https://www.openwall.com/lists/oss-security/2025/10/27/12