Skip to main content

Codeready Linux Builder CVE-2025-13601

HIGH
Integer Overflow or Wraparound (CWE-190)
2025-11-26 secalert@redhat.com
Buffer Overflow Integer Overflow Codeready Linux Builder Codeready Linux Builder For Ibm Z Systems Codeready Linux Builder For Power Little Endian Codeready Linux Builder For X86 64 Enterprise Linux For Arm 64 Enterprise Linux For Ibm Z Systems Enterprise Linux For Power Little Endian Enterprise Linux For X86 64 Codeready Linux Builder For Arm64 Enterprise Linux Server Aus Codeready Linux Builder For Arm64 Eus Enterprise Linux For X86 64 Eus Enterprise Linux Server For Power Little Endian Enterprise Linux Server For Power Little Endian Eus Codeready Linux Builder For Ibm Z Systems Eus Codeready Linux Builder For Power Little Endian Eus Codeready Linux Builder For X86 64 Eus Enterprise Linux For Arm 64 Eus Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Little Endian Eus Enterprise Linux Server Tus Ceph Storage Discovery Glib Openshift Container Platform Openshift Container Platform For Arm64 Openshift Container Platform For Ibm Z Openshift Container Platform For Linuxone Openshift Container Platform For Power
7.7
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.7 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Apr 19, 2026 - 20:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 19, 2026 - 20:22 vuln.today
cvss_changed
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 19, 2026 - 06:22 vuln.today
PoC Detected
Mar 19, 2026 - 06:16 vuln.today
Public exploit code
CVE Published
Nov 26, 2025 - 15:15 nvd
HIGH 7.7

DescriptionCVE.org

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

AnalysisAI

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and high-availability impacts through integer overflow in escaped string length calculation. The vulnerability affects Red Hat Enterprise Linux 9.0 and 10.0 across multiple architectures (x86_64, ARM64, IBM Z, PowerPC). Vendor patches are available via multiple RHSA advisories. Publicly available exploit code exists, but EPSS score remains extremely low (0.01%, 1st percentile), suggesting minimal real-world exploitation activity despite the availability of technical details.

Technical ContextAI

GLib is a foundational low-level library providing core application building blocks for C programs, including data structure handling, portability wrappers, and utilities like URI string manipulation. The g_escape_uri_string() function is designed to percent-encode characters in URI strings that are not allowed in specific URI components. The vulnerability stems from CWE-190 (Integer Overflow or Wraparound) in the buffer size calculation logic when processing strings containing an extremely large number of characters requiring escaping. When calculating the length needed for the escaped output, the integer arithmetic overflows, resulting in allocation of an undersized buffer on the heap. Subsequent write operations during the escaping process then write beyond the allocated buffer boundary, creating a heap-based buffer overflow condition. This affects systems using GLib as a dependency, which includes numerous GNOME applications and system utilities across Red Hat Enterprise Linux distributions on x86_64, aarch64, s390x, and ppc64le architectures.

RemediationAI

Apply vendor-released patches from Red Hat security advisories corresponding to your specific RHEL version and architecture using standard package management (dnf update glib2 or yum update glib2). For RHEL 9.0 systems, consult advisories RHSA-2026:0936, RHSA-2026:0975, RHSA-2026:0991, RHSA-2026:1323-1327, RHSA-2026:1465, and RHSA-2026:1608. For RHEL 10.0 systems, reference RHSA-2026:1624-1627, RHSA-2026:1652, and RHSA-2026:1736. Complete advisory URLs and architecture-specific package details are available at access.redhat.com/errata. If immediate patching is not feasible, implement application-level input validation to restrict URI string length processed by GLib-dependent applications, though this workaround has limited effectiveness since GLib is a dependency of numerous system components and enforcing length limits may break legitimate functionality. Monitor processes using GLib for unexpected crashes that could indicate exploitation attempts, and consider restricting local access privileges to reduce attack surface, though the PR:N vector means even unprivileged local users can trigger the condition.

More in Codeready Linux Builder

View all
CVE-2022-0435 HIGH POC
8.8 Mar 25

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with

CVE-2023-0179 HIGH POC
7.8 Mar 27

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. Rated high severity (CVSS 7.8)
CVE-2025-3155 HIGH POC
7.4 Apr 03

A flaw was found in Yelp. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication

CVE-2025-2784 MEDIUM POC
6.5 Apr 03

A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authenticati
CVE-2019-3460 MEDIUM POC
6.5 Apr 11

A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.

CVE-2019-3459 MEDIUM POC
6.5 Apr 11

A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1. Rated

CVE-2023-5633 HIGH
7.8 Oct 23

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in
CVE-2022-0330 HIGH
7.8 Mar 25

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may r
CVE-2022-1011 HIGH
7.8 Mar 18

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). Rated high sev
CVE-2022-0516 HIGH
7.8 Mar 10

A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linu
CVE-2024-1488 HIGH
7.3 Feb 15

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound grou
CVE-2019-11135 MEDIUM
6.5 Nov 14

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potenti

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8
CVE-2013-3940 CRITICAL
9.3

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.4 Container suse/sle-micro/base-5.5:2.0.4-5.8.230 Container suse/sle-micro/kvm-5.5:2.0.4-3.5.441 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Micro-5-3-BYOS Image SLES15-SP4-Micro-5-3-BYOS-Azure Image SLES15-SP4-Micro-5-4-BYOS Image SLES15-SP4-Micro-5-4-BYOS-Azure Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-Micro-5-5 Image SLES15-SP5-Micro-5-5-Azure Image SLES15-SP5-Micro-5-5-BYOS Image SLES15-SP5-Micro-5-5-BYOS-Azure Image SLES15-SP5-Micro-5-5-EC2 Affected
Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.4 Affected
Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image proxy-httpd-image Image server-image Affected
Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/server-attestation:latest Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:latest Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image proxy-salt-broker-image Image server-hub-xmlrpc-api-image Image server-saline-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.115 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.81 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.102 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.117 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected

Share

CVE-2025-13601 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy