What is the CVSS score of CVE-2025-4056?

CVE-2025-4056 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of GLib are affected by CVE-2025-4056?

A denial-of-service vulnerability in GNOME GLib on Windows platforms allows attackers to crash applications by supplying excessively long command-line strings, impacting availability of Windows…

How to fix or mitigate CVE-2025-4056?

Within 24 hours: Inventory all Windows applications linking GNOME GLib; test command-line argument handling with strings >8,000 characters to identify crash conditions. Within 7 days: Implement input validation restricting command-line argument length (recommend maximum 1,024 characters for user-supplied input); deploy application-level crash monitoring and auto-restart capabilities. Within 30 days: Subscribe to GNOME GLib security advisories; maintain inventory for rapid patching when vendor releases update.

GLib CVE-2025-4056

HIGH

Code Injection (CWE-94)

2025-07-28 secalert@redhat.com

Code Injection Denial Of Service Microsoft RCE Glib

High

Disputed · 7.5 Vendor: redhat

Severity by source

Sources disagree (Low–High)

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Trigger is a local application spawning a child process, so AV:L; availability-only DoS gives A:H with C:N/I:N, and no privileges needed to supply oversized input.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 08:30 vuln.today

CVE Published

Jul 28, 2025 - 13:15 cve.org

HIGH 7.5

DescriptionCVE.org

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

AnalysisAI

Denial of service in GNOME GLib on Windows platforms occurs when an application uses GLib's process-spawning functions with excessively long command lines, causing the spawn operation to fail or crash the host process and disrupt availability. The flaw affects the GLib library's Windows command-line handling and impacts any Windows application that links GLib and passes attacker-influenced long argument strings to a child process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; despite Red Hat tags mentioning RCE/Code Injection, the CVSS impact metrics confirm availability-only impact (C:N/I:N/A:H).

Technical ContextAI

GLib is the low-level core utility library underpinning GNOME and a large ecosystem of cross-platform GTK applications (GIMP, Inkscape, Pidgin, and many others), providing data structures, an event loop, and OS abstraction including the g_spawn_* process-creation API. On Windows, command-line construction and the CreateProcess path differ fundamentally from POSIX exec semantics: arguments must be flattened and quoted into a single command string subject to Windows length limits (the ~32,767-character CreateProcess ceiling and shorter cmd.exe limits). The assigned CWE-94 (Improper Control of Generation of Code, 'Code Injection') frames the root cause as faulty generation of the spawned command, though the observed real-world impact is a resource/availability failure rather than confirmed arbitrary code execution. The affected component is identified by CPE cpe:2.3:a:gnome:glib (all versions) and the behavior is platform-specific to Windows.

RemediationAI

No vendor-released patch version was identified at time of analysis; the references point to issue/bug trackers (GNOME GLib issue 3668 and Red Hat Bugzilla 2362826) rather than a tagged patched release, so monitor https://gitlab.gnome.org/GNOME/glib/-/issues/3668 and https://access.redhat.com/security/cve/CVE-2025-4056 for the fixed version and upgrade GLib once published. As compensating controls for Windows deployments, restrict or validate the length of arguments before passing them to GLib spawn APIs (reject or truncate command lines approaching the Windows ~32,767-character CreateProcess limit), which prevents the crash at the cost of failing legitimate oversized invocations; where feasible, sanitize and bound any untrusted input that flows into child-process arguments, and avoid passing user-controlled data directly into process spawning. If a specific application is the vector, consider running it with reduced privileges and restart supervision so a DoS crash does not cascade, accepting the trade-off of additional operational monitoring.