CVE-2025-47816 is a low severity memory flaw (CVSS 2.9) in GNU PSPP through version 2.0.1. An out of bounds read can happen in spvxml_parse_attributes in spvxml-helpers.c, related to extra content at the end of a document. The record lists no fixed version, so check the PSPP bug tracker and your distribution before deciding what to do.
What's affected
The record says libpspp-core.a in GNU PSPP through 2.0.1 is affected. An out of bounds read can happen in spvxml_parse_attributes in spvxml-helpers.c, related to extra content at the end of a document. The reference is bug number 67073 on the GNU Savannah tracker.
The vector is local, with high attack complexity and no privileges. That means an attacker needs a way to get a crafted file in front of PSPP on a machine you run, and the timing or conditions must line up. The impact scores are low, which gives the 2.9 figure.
I could not confirm a patched version from the record, so check the tracker and your package source.
The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
PSPP is a free statistics program, and its library is also built into other tools that read SPSS style data. First find out whether you have it:
pspp --version
which pspp pspp-convert
On Debian or Ubuntu, dpkg -l | grep pspp lists the package and version. On Fedora or Red Hat systems, rpm -qa | grep pspp does the same. If the version is 2.0.1 or lower, you are in the range in the record.
Then ask where PSPP reads files from. A shared analysis server that opens files uploaded by many users is a bigger concern than a laptop that opens its owner's own data.
What to do now
- Check whether PSPP or pspp-convert is installed on your analysis machines.
- Open the Savannah bug and your distribution's security tracker to see whether a fixed package exists.
- Install a fixed package when one is available.
- Until then, avoid opening PSPP output or data files from sources you do not trust.
- If PSPP runs as a service that handles uploads, run it under a low privilege account with limited file access.
- Add the package to your inventory so you see updates.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
The record lists CWE-125. A heap based buffer overflow or an out of bounds read happens when a program reads or writes past the end of a block of memory. The memory error here comes from processing a crafted archive or document, which is why the issue is tied to file handling code.
The score is low to medium because the attack is local and hard to repeat. The practical lesson is about where untrusted files go. Any tool that parses complex file formats, such as zip based containers with XML inside, can have this class of bug, so keep such tools away from files you cannot vouch for.
Quick check
Is there a fixed PSPP version for CVE-2025-47816?
The record does not list one. Check the Savannah bug and your distribution's package updates.
Can this be triggered from the network?
The vector is local. The risk comes from opening a crafted file on a machine you control.
Sources
Last reviewed: 18 October 2026.
