CVE-2018-19491: An issue was discovered in post.trm in Gnuplot 5.2.5.

Security readout for executives and security teams

Gnuplot 5.2.5 has a buffer overflow tied to font handling when the PostScript terminal backend is used. Business risk is mainly for systems that process untrusted plot commands or generated reports. The public sources do not provide CVSS, confirmed impact, or active exploitation evidence. Exposure is most likely on systems with affected Gnuplot or distro packages that render PostScript output from untrusted or semi-trusted inputs, such as reporting, plotting, or automation pipelines. Environments using only trusted local plotting have lower practical exposure. Prioritize patching where Gnuplot processes external or customer-controlled plotting inputs. For internal-only trusted plotting, handle through normal vulnerability maintenance, while confirming vendor package status and exposure through automation pipelines. Mitigation focus: Update Gnuplot packages using Debian, Ubuntu, openSUSE, or other vendor security guidance.; Check upstream Gnuplot guidance and fixes for post.trm and PS_options.; Avoid processing untrusted Gnuplot scripts or font settings until patched..

Prepared

Jun 6, 2026, 22:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.