CVE-2025-47814
📋 TL;DR
CVE-2025-47814 is a heap-based buffer overflow vulnerability in GNU PSPP's libpspp-core.a library that occurs when processing specially crafted ZIP files. Attackers can exploit this to potentially execute arbitrary code or crash the application. Users of GNU PSPP versions up to 2.0.1 are affected.
💻 Affected Systems
- GNU PSPP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if PSPP processes malicious ZIP files from untrusted sources.
Likely Case
Application crash (denial of service) when processing malformed ZIP archives.
If Mitigated
Limited impact if PSPP only processes trusted data sources and runs with minimal privileges.
🎯 Exploit Status
Exploitation requires the attacker to supply a malicious ZIP file that PSPP processes. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2 or later
Vendor Advisory: https://savannah.gnu.org/bugs/?67074
Restart Required: Yes
Instructions:
1. Check current PSPP version with 'pspp --version'. 2. Download latest version from GNU PSPP website. 3. Compile and install following official build instructions. 4. Restart any running PSPP processes.
🔧 Temporary Workarounds
Restrict ZIP file processing
allLimit PSPP to only process ZIP files from trusted sources and implement input validation.
Run with reduced privileges
linuxExecute PSPP with minimal user privileges to limit potential damage from exploitation.
sudo -u nobody pspp [options]
🧯 If You Can't Patch
- Implement strict access controls to prevent untrusted users from supplying ZIP files to PSPP
- Monitor for abnormal PSPP process crashes or memory usage patterns
🔍 How to Verify
Check if Vulnerable:
Run 'pspp --version' and check if version is 2.0.1 or earlier.Check Version:
pspp --versionVerify Fix Applied:
After patching, verify version is 2.0.2 or later with 'pspp --version' and test processing known valid ZIP files.📡 Detection & Monitoring
Log Indicators:
- PSPP process crashes
- Memory access violation errors in system logs
- Abnormal termination of pspp processes
Network Indicators:
- Unusual file transfers to systems running PSPP
SIEM Query:
process_name:"pspp" AND (event_type:"crash" OR memory_violation:"true")