CVE-2018-19490: An issue was discovered in datafile.c in Gnuplot 5.2.5.

Security readout for executives and security teams

Gnuplot 5.2.5 can mishandle an excessively long plot range value, causing a heap buffer overflow. Business risk is highest where Gnuplot processes files, scripts, or generated plotting input from untrusted sources. The supplied sources show vendor security updates, but no CISA KEV listing or confirmed active exploitation. Exposure is likely limited to systems running vulnerable Gnuplot 5.2.5 or affected distribution packages, especially batch plotting, report generation, CI jobs, or services that process untrusted plotting input. The source bundle does not identify broader affected version ranges beyond Gnuplot 5.2.5 and vendor package updates. Treat this as a targeted patching item, not an emergency based on the supplied evidence. Prioritize environments where Gnuplot handles external or user-controlled input, because memory corruption bugs can create higher impact when exposed through automation or services. Mitigation focus: Apply Debian, Ubuntu, or openSUSE security updates where those packages are used.; For other platforms, check Gnuplot or operating-system vendor guidance for fixed builds.; Restrict Gnuplot from processing untrusted scripts or generated plot parameters until patched..

Prepared

Jun 6, 2026, 22:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.