CVE-2025-48188

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-48193.1A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/onli CVE-2025-48205.3Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate CVE-2025-4820010.0The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.CVE-2025-482018.6The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.CVE-2025-482025.3The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482036.4The cs_seo extension through 9.2.0 for TYPO3 allows XSS.CVE-2025-482046.8The ns_backup extension through 13.0.0 for TYPO3 allows command injection.CVE-2025-482058.6The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482066.1The ns_backup extension through 13.0.0 for TYPO3 allows XSS.CVE-2025-482078.6The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482088.8Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The att CVE-2025-48217.5Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate