CVE-2025-5899: 
Linux Debian vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-5899) was discovered in GNU PSPP (commit 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb) affecting the parsevariablesoption function in utilities/pspp-convert.c. The vulnerability involves improper memory management leading to free of memory not on the heap. The issue requires local access to exploit and has been publicly disclosed (NVD, VulDB).

The vulnerability is classified as CWE-590 (Free of Memory not on the Heap) and has received multiple severity ratings. According to CVSS 4.0, it has a score of 4.8 (MEDIUM) with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. Under CVSS 3.1, it scores 5.3 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD, Wiz).

The vulnerability can lead to memory corruption issues when the parsevariablesoption function is called, potentially resulting in program crashes or unpredictable behavior in the GNU PSPP application (VulDB, Wiz).

Currently, there are no fixed versions available for the affected packages. The vulnerability affects multiple versions of Debian, including bullseye (1.4.1-1), bookworm (1.6.2-2), and sid/trixie (2.0.1-1) (Debian Tracker).