GNU Pspp
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in GNU Pspp.
By the Year
In 2026 there have been 0 vulnerabilities in GNU Pspp. Last year, in 2025 Pspp had 8 security vulnerabilities published. Right now, Pspp is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 8 | 6.98 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 2 | 7.80 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 0.00 |
| 2018 | 1 | 0.00 |
It may take a day or so for new Pspp vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent GNU Pspp Security Vulnerabilities
Critical Local Free-Not-Heap in GNU PSPP parse_variables_option
CVE-2025-5899
5.3 - Medium
- June 09, 2025
A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Free of Memory not on the Heap
Critical OOBW in GNU PSPP parse_variables_option (pspp-convert.c)
CVE-2025-5898
5.3 - Medium
- June 09, 2025
A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to out-of-bounds write. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Buffer Overflow
GNU PSPP calloc Int Overflow via -l - Public Exploit
CVE-2025-5001
5.5 - Medium
- May 20, 2025
A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function calloc of the file pspp-convert.c. The manipulation of the argument -l leads to integer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Integer Overflow or Wraparound
Heap Buffer Over-Read in libpspp-core.a of GNU PSPP <=2.0.1
CVE-2025-48188
5.5 - Medium
- May 16, 2025
libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read.
Heap overflow in libpspp-core.a (GNU PSPP 2.0.1 or earlier, inflate_read)
CVE-2025-47815
9.8 - Critical
- May 10, 2025
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in zip-reader.c.
Memory Corruption
Heap Buffer Overflow in libpspp-core.a of GNU PSPP < 2.0.1
CVE-2025-47814
9.8 - Critical
- May 10, 2025
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in zip-reader.c.
Memory Corruption
GNU PSPP <2.0.1 OOB Read in spvxml_parse_attributes
CVE-2025-47816
9.1 - Critical
- May 10, 2025
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at the end of a document.
DOS in GNU PSPP <2.0.1 via libpspp-core.a (var_set_leave_quiet Assertion)
CVE-2025-47229
5.5 - Medium
- May 03, 2025
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted input data, such as data that triggers a call from src/data/dictionary.c code into src/data/variable.c code.
PSPP 1.6.2 Heap Overflow in read_string (pspp-dump-sav.c)
CVE-2022-39832
7.8 - High
- September 05, 2022
An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_string in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Memory Corruption
PSPP 1.6.2 Heap Buffer Overflow in read_bytes_internal (pspp-dump-sav.c)
CVE-2022-39831
7.8 - High
- September 05, 2022
An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact. This issue is different from CVE-2018-20230.
Memory Corruption
There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0
CVE-2019-9211
- February 27, 2019
There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead to denial of service.
An issue was discovered in PSPP 1.2.0
CVE-2018-20230
- December 19, 2018
An issue was discovered in PSPP 1.2.0. There is a heap-based buffer overflow at the function read_bytes_internal in utilities/pspp-dump-sav.c, which allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
