CVE-2025-8735

EUVD-2025-24014 · Published Aug 8, 2025

A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Weaknesses

CWE-404CWE-476

CVSS scores

v4.01.9CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.13.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
v2.01.7AV:L/AC:L/Au:S/C:N/I:N/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation Impact

T1068Exploitation for Privilege Escalation T1498.001Direct Network Flood T1499Endpoint Denial of Service T1499.001OS Exhaustion Flood T1499.003Application Exhaustion Flood

References

Potentially impacted assets

See if this affects your attack surface

CVE-2025-8735

Weaknesses

CVSS scores

MITRE ATT&CK

References

Potentially impacted assets

Our latest news

PHP2Shell: Two Critical RCE Flaws in PHP (CVSS 9.2)

Manage External Security Across All Your Entities

Will AI Become the Next Hacker? Bruce Schneier Answers at DEF CON 34

Take 15 minutes to discover our platform with our experts