CVE-2014-9474: Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attacker...

Security readout for executives and security teams

This is an old buffer overflow in GNU MPFR, a math library used by other software. Affected versions before 3.1.2-p11 may write outside memory while converting strings to high-precision numbers. Business urgency depends on whether exposed applications parse attacker-controlled numeric input through MPFR. Exposure is most likely in systems running software linked against GNU MPFR before 3.1.2-p11, especially where numeric strings can come from users, files, APIs, or batch inputs. The provided affected-product metadata is incomplete. Prioritize based on asset exposure. Patch routinely for internal-only systems, and faster for services processing untrusted numeric input. The missing CVSS and unspecified impact reduce certainty but do not remove the memory-corruption risk. Mitigation focus: Upgrade GNU MPFR to 3.1.2-p11 or a vendor-fixed package.; Apply Fedora, Gentoo, or other distribution security updates where applicable.; Rebuild or restart dependent applications after updating MPFR libraries..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.