How many CVEs does sourceware have?

sourceware has 297 published CVE records since 2017, including 65 in the last two years.

How many sourceware CVEs are in CISA KEV?

Yes — 1 of sourceware's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which sourceware products have the most CVEs?

The sourceware products with the most published CVEs are binutils-gdb, elfutils, glibc.

What are the most common weakness types in sourceware CVEs?

sourceware's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-476 (NULL Pointer Dereference), CWE-122 (Heap-based Buffer Overflow), CWE-400 (Uncontrolled Resource Consumption).

Are there public exploits for sourceware vulnerabilities?

Yes — 83 of sourceware's CVEs have a known public exploit.

How many critical sourceware vulnerabilities are there?

sourceware has 6 critical and 105 high-severity CVEs.

What is the average severity of sourceware CVEs?

The average CVSS base score across sourceware's scored CVEs is 6.2.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

297 CVEs

1 in CISA KEV

sourceware Vulnerabilities

Name: sourceware vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for sourceware.

297

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

83

Public exploits

PoC or exploit code

6.2

Avg CVSS

2017–2026

Overview

sourceware has 297 published CVE records since 2017, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 83 have a known public exploit. The average CVSS base score across scored CVEs is 6.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting sourceware products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on sourceware's vulnerability posture, as a share of its 297 published CVEs.

Average CVSS: 6.2
Critical / high: 37%
Actively exploited (KEV): 0%
Public exploit available: 28%
Patch available: 93%

Severity and exploitation

How the CVSS severity of sourceware's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High105

Medium170

Low16

In CISA’s Known Exploited Vulnerabilities catalog

1

One of sourceware's CVEs is confirmed exploited in the wild.

Public exploits

83

83 of sourceware's CVEs have a known public exploit available.

Most affected products

The sourceware products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in sourceware CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish sourceware CVE records.

Disclosure activity by year

How many sourceware CVEs were published each year.

2019

25

2020

6

2021

11

2022

1

2023

26

2024

1

2025

44

2026

21

Latest sourceware CVEs

The most recently disclosed vulnerabilities affecting sourceware.

Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
CWE-122
High · CVSS 7.8
EPSS 0.2%2026-04-22
Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files
CWE-400
Medium · CVSS 5.5
EPSS 0.1%2026-04-22
Binutils: binutils: denial of service via crafted elf file
CWE-476
Medium · CVSS 5.0
EPSS 0.1%2026-04-22
scanf %mc off-by-one heap buffer overflow
CWE-122
Critical · CVSS 9.8
EPSS 0.5%2026-04-20
Potential buffer under-read in ungetwc
CWE-127
High · CVSS 7.5
EPSS 0.4%2026-04-20
iconv crash due to assertion failure with untrusted input
CWE-617
High · CVSS 7.5
EPSS 0.4%2026-03-30
Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library
CWE-125
Medium · CVSS 6.1
EPSS 0.2%2026-03-23
gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
CWE-20
Medium · CVSS 5.4
EPSS 0.2%2026-03-20
gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
CWE-125
High · CVSS 7.5
EPSS 0.3%2026-03-20
Binutils: gnu binutils: information disclosure via specially crafted xcoff object file
CWE-125
High · CVSS 7.1
EPSS 0.2%2026-03-15
Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker
CWE-125
High · CVSS 7.1
EPSS 0.3%2026-03-15
Medium vulnerability · 2026-03-09
CWE-835
Medium · CVSS 6.2
EPSS 0.2%2026-03-09

Track new sourceware CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor sourceware CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Micro Focus304 CVEs Nagios303 CVEs deltaww303 CVEs discourse296 CVEs Open-Xchange293 CVEs Eclipse Foundation290 CVEs Progress289 CVEs PDF-XChange289 CVEs

Browse all vendors

Frequently asked questions

Common questions about sourceware vulnerabilities.

How many CVEs does sourceware have?: sourceware has 297 published CVE records since 2017, including 65 in the last two years.
How many sourceware CVEs are in CISA KEV?: Yes — 1 of sourceware's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which sourceware products have the most CVEs?: The sourceware products with the most published CVEs are binutils-gdb, elfutils, glibc.
What are the most common weakness types in sourceware CVEs?: sourceware's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-476 (NULL Pointer Dereference), CWE-122 (Heap-based Buffer Overflow), CWE-400 (Uncontrolled Resource Consumption).
Are there public exploits for sourceware vulnerabilities?: Yes — 83 of sourceware's CVEs have a known public exploit.
How many critical sourceware vulnerabilities are there?: sourceware has 6 critical and 105 high-severity CVEs.
What is the average severity of sourceware CVEs?: The average CVSS base score across sourceware's scored CVEs is 6.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track sourceware vulnerabilities

Monitor new sourceware vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing