Skip to main content

Glib CVE-2025-14512

MEDIUM
Integer Overflow or Wraparound (CWE-190)
2025-12-11 secalert@redhat.com
Buffer Overflow Integer Overflow Red Hat Enterprise Linux Glib Openshift Gnome
6.5
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Craft malicious filesystem attribute
  2. Delivery
    Deliver via network share or local file
  3. Exploit
    User opens file manager or file properties
  4. Install
    GIO invokes escape_byte_string()
  5. C2
    Integer overflow occurs
  6. Execute
    Heap buffer overflow corrupts memory
  7. Impact
    Application crash (DoS) or memory corruption

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The vulnerability is activated when the escape_byte_string() function processes a filesystem attribute value with a length that, when multiplied or transformed during integer encoding, overflows the integer type and results in insufficient heap allocation. Exploitation requires: (1) The application or system service must use GIO to access or display file attributes-common in desktop environments (file managers, preview generators, property dialogs) and some server services (image thumbnail caching, metadata indexing). (2) The attacker must control the source of the attribute value-either by crafting a local file with malicious xattr, hosting a hostile network filesystem (SMB/NFS), or providing a remote HTTP resource with crafted headers that GIO interprets as attributes. (3) A user or automated process must trigger GIO's attribute processing-not passive network access; the attack requires explicit file browsing, preview generation, or metadata enumeration. (4) The attribute value must be sufficiently large and structured to trigger the integer overflow without causing immediate rejection by earlier validation (if present). The vulnerability does NOT affect systems that: do not mount or access network filesystems, run headless servers without file manager daemons, or isolate GLib-using processes such that attribute processing is blocked at the OS level (SELinux, AppArmor). This is not a default remote code execution vector; it is a specific code path exploitation requiring user interaction or service misconfiguration.
Impact

CVSS 6.5 (network, low complexity, no privileges, no scope change, high availability impact) suggests measurable risk, but EPSS 0.07% (percentile 22) and absence of public POC or KEV listing indicate exploitation remains theoretical or highly constrained. The discrepancy warrants scrutiny: the network vector combined with low complexity typically correlates with higher EPSS, yet this CVE's percentile places it in the bottom quartile of exploitability. The mandatory user interaction (UI:R in CVSS) is the likely limiting factor-the attacker cannot trigger exploitation via passive network traffic alone; a user must interact with a malicious file, mount a hostile filesystem, or access a compromised network resource. The attack surface narrows further if GIO's escape_byte_string() is invoked only in specific code paths (e.g., thumbnail generation, file properties dialogs, network resource enumeration). Red Hat's RHSA-2026:7461 indicates patch availability, suggesting the vulnerability is understood and remediable. Real-world priority depends on deployment context: desktop systems where users interact with untrusted files face higher risk than server-only deployments; however, widespread GLib usage means patch coverage affects many downstream projects. The low EPSS despite moderate CVSS and presence of a patch advisory suggests this is a legitimate vulnerability but not a critical priority for emergency response-standard patch cycles are appropriate unless deployed in high-user-interaction environments.
Exploit ScenarioDerived

An attacker crafts a malicious file with oversized extended attributes (xattr) or creates a hostile SMB/NFS network share with crafted attribute metadata. When a user opens the file manager (Nautilus) or a file properties dialog, GIO invokes escape_byte_string() to process the attribute value, triggering the integer overflow. The heap buffer overflow corrupts adjacent memory, causing the application to crash (DoS) or, in advanced scenarios, potentially enabling code execution if the overflow overwrites function pointers or heap metadata. The attack requires the user to interact with the malicious file or share-passive network listening will not trigger exploitation.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 19, 2026

Integer overflow in GLib's GIO escape_byte_string() function enables heap buffer overflow and denial-of-service when processing malicious filesystem attribute values over the network. The vulnerability affects GLib across GNOME, Red Hat Enterprise Linux 7-10, and OpenShift 4.0+, requiring only unauthenticated network access and user interaction. EPSS score of 0.07% (percentile 22) indicates low exploitation probability despite CVSS 6.5, suggesting the attack requires specific file/attribute handling conditions; no public exploit or active exploitation (CISA KEV) confirmed at analysis time.

RemediationAI

Primary fix: Apply the vendor-released security patch via the distribution's package manager. Red Hat Enterprise Linux users should install the patched glib2 package from RHSA-2026:7461 (advisory URL: https://access.redhat.com/errata/RHSA-2026:7461). GNOME upstream users should upgrade to the patched GLib release available at https://gitlab.gnome.org/GNOME/glib/-/issues/3845. For systems unable to patch immediately, implement network-level mitigations: (1) restrict access to network filesystem protocols (SMB, NFS, WebDAV) to trusted sources only-block unauthorized mount attempts and limit SMB/NFS to internal networks with ACLs; side effect is reduced file sharing flexibility. (2) Disable or restrict GIO-based file managers (Nautilus/GNOME Files) on desktop systems if users do not require network file browsing-reduces exposure surface but limits usability. (3) Monitor system logs for unexpected filesystem attribute access or buffer overflow crashes in GLib-dependent applications (file managers, preview generators, system services); configure SELinux or AppArmor to confine GLib-using processes to prevent lateral movement post-exploitation. Most effective is prompt patching given RHSA advisory availability and low activation barriers (patch is standard distribution maintenance).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib is the core utility library used by GNOME and widely deployed across Linux distributions. The vulnerability resides in GIO's escape_byte_string() function, part of the input/output abstraction layer responsible for handling filesystem metadata and remote mount attributes. The root cause is CWE-190 (integer overflow), where integer arithmetic on attribute value lengths fails to validate boundaries before allocation or buffer operations. When crafted malicious attribute values (e.g., extended filesystem attributes, SMB/NFS mount options, or file metadata) are processed, the integer overflow allows an attacker to bypass length checks, resulting in a heap buffer overflow. This affects all GLib versions where this function lacks proper integer sanitization. The network attack vector (AV:N) indicates remote filesystems or network-accessible attribute sources (e.g., SMB, NFS, HTTP-based file services) can trigger exploitation.

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 6.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Affected Products (CPE)CVE.org

cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.4 Container suse/sle-micro/base-5.5:2.0.4-5.8.230 Container suse/sle-micro/kvm-5.5:2.0.4-3.5.441 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Micro-5-3-BYOS Image SLES15-SP4-Micro-5-3-BYOS-Azure Image SLES15-SP4-Micro-5-4-BYOS Image SLES15-SP4-Micro-5-4-BYOS-Azure Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-Micro-5-5 Image SLES15-SP5-Micro-5-5-Azure Image SLES15-SP5-Micro-5-5-BYOS Image SLES15-SP5-Micro-5-5-BYOS-Azure Image SLES15-SP5-Micro-5-5-EC2 Affected
Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.4 Affected
Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image proxy-httpd-image Image server-image Affected
Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/server-attestation:latest Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:latest Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image proxy-salt-broker-image Image server-hub-xmlrpc-api-image Image server-saline-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.115 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.81 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.102 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.117 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/335862 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4441/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4442/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4504/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0018/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20032/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20045/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20493/ REF https://access.redhat.com/errata/RHSA-2026:15953 REF https://access.redhat.com/errata/RHSA-2026:15969 REF https://access.redhat.com/errata/RHSA-2026:15971 REF https://access.redhat.com/errata/RHSA-2026:19148 REF https://access.redhat.com/errata/RHSA-2026:19361 REF https://access.redhat.com/errata/RHSA-2026:19452 REF https://access.redhat.com/errata/RHSA-2026:19457 REF https://access.redhat.com/errata/RHSA-2026:19459 REF https://access.redhat.com/errata/RHSA-2026:19460 REF https://access.redhat.com/errata/RHSA-2026:19523 REF https://access.redhat.com/errata/RHSA-2026:19524 REF https://access.redhat.com/errata/RHSA-2026:19565 REF https://access.redhat.com/errata/RHSA-2026:19567 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:22634 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:7461 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2025-14512 REF https://bugzilla.redhat.com/show_bug.cgi?id=2421339 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3845

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy