GLib CVE-2025-4056

Exploitation requires a Windows platform specifically, a host application that is linked against GLib and calls its process-spawning functions (g_spawn family), and that application supplying a sufficiently long command line - typically because attacker-influenced input is concatenated into the child-process arguments without length validation. Limiting factors that reduce real-world risk: the bug does not manifest on Linux/macOS, it cannot be triggered unless an application actually reaches the spawn-with-long-command-line code path, and impact is confined to denial of service (no confidentiality or integrity loss). The published CVSS AV:N is questionable because the described trigger is a local application operation rather than a directly network-exposed service; whether it is remotely reachable depends entirely on whether a network-facing app forwards untrusted oversized input into GLib spawn calls - verify with the vendor.

Signals here are partially conflicting and should be weighed carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H, base 7.5) implies trivial remote unauthenticated triggering, but the description clearly scopes the issue to a local application spawning a child process with long command lines on Windows - a local/application-controlled condition, not a directly network-reachable one, so the AV:N rating likely overstates real reachability and should be verified with the vendor. Impact is availability-only (C:N/I:N), so this is a denial-of-service issue, not the RCE/Code-Injection that the Red Hat tags suggest; the tags appear to reflect the CWE-94 class rather than a demonstrated code-execution outcome. No EPSS score, KEV listing, SSVC decision, or POC was provided, so there is no evidence of active or automatable exploitation. Net assessment: a moderate, platform-limited availability bug that is realistically lower priority than the 7.5 base score implies unless an application directly forwards untrusted, attacker-sized input into GLib's spawn APIs on Windows.

An attacker supplies an unusually long input (for example a crafted filename, URL, or parameter) to a Windows application that forwards that value into a GLib g_spawn call to launch a helper process. The oversized command line exceeds Windows handling limits, and instead of degrading gracefully the spawn fails in a way that crashes or hangs the application, denying service. No public exploit code was identified, and exploitation requires the target application to pass attacker-influenced data into GLib's spawn path.