The vulnerability occurs in pointer arithmetic when parsing an unusually large key value (UINTMAX_MAX) in traditional key syntax (+POS1.C1). If a user executes a crafted command like sort +0.18446744073709551615R, pointer arithmetic may wrap around and return a pointer before the start of the allocated buffer. This flaw can lead to an out-of-bounds memory read and potentially information disclosure.

Affected Versions: GNU Coreutils versions 7.2 through the current version
are affected.