The vulnerability CVE-2025-5278 is a heap buffer under-read in the GNU Coreutils sort utility, which is part of the coreutils package. This flaw allows reading memory before the allocated buffer during sort operations involving key specifications. Red Hat Product Security has rated this issue as moderate severity and has issued a security advisory (RHSA-2026:28911) with updated coreutils packages for Red Hat Enterprise Linux 9 on various architectures including x86_64, s390x, ppc64le, and aarch64. The advisory provides updated package versions to remediate the issue.

The heap buffer under-read vulnerability could lead to unexpected behavior or crashes in the sort utility, potentially causing denial of service or information disclosure depending on the context of use. The advisory rates the impact as moderate, indicating a limited but meaningful security risk.

Red Hat has released updated coreutils packages that fix this vulnerability. Users of Red Hat Enterprise Linux 9 should apply the security update as detailed in Red Hat advisory RHSA-2026:28911 and the referenced update article https://access.redhat.com/articles/11258. Applying the official patch eliminates the vulnerability. No additional mitigations are indicated or required beyond applying the update.