CVE-2025-47816: 
NixOS vulnerability analysis and mitigation

libpspp-core.a in GNU PSPP through version 2.0.1 contains a vulnerability that was discovered on May 3, 2025, and publicly disclosed on May 10, 2025. The issue allows attackers to cause an out-of-bounds read in the spvxml_parse_attributes function within spvxml-helpers.c, specifically when handling extra content at the end of a document (Wiz Report, NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) that occurs in the spvxml_parse_attributes function within spvxml-helpers.c. According to the CVSS v3.1 scoring, it has received a base score of 2.9 (LOW) with the vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating local access, high attack complexity, no privileges required, and low availability impact (NVD).

The vulnerability affects system availability by causing a segmentation fault when processing malformed XML documents. The impact is considered low as it requires local access and has no direct effect on confidentiality or integrity of the system (Wiz Report).

The vulnerability requires local access and has high attack complexity. No public exploits have been reported at the time of disclosure (NVD).