CVE-2025-14512

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Medium6.5EPSS 0.58%

Published: 11 Dec 2025
Updated: 5 Nov 2026
Reserved: 11 Dec 2025
Assigned by: redhat

Description

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

Scores

CVSS scores of CVE-2025-14512, by who scored it
Scored by	CVSS	Score	Vector
redhatCNA (assigner)	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 0.58% · top 52% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

CWE-190: Integer Overflow or Wraparound (opens in a new tab)All about CWE-190 and its CVEs

Affected products

GNOME · glib
- affected < 2.86.3
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:2.80.4-10.el10_1.13 – < *
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:2.80.4-12.el10_2.13 – < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support
- unaffected 0:2.80.4-4.el10_0.9 – < *
Red Hat · Red Hat Enterprise Linux 8
- unaffected 0:2.56.4-169.el8_10 – < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- unaffected 0:2.56.4-10.el8_4.5 – < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- unaffected 0:2.56.4-10.el8_4.5 – < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- unaffected 0:2.56.4-158.el8_6.5 – < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service
- unaffected 0:2.56.4-158.el8_6.5 – < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
- unaffected 0:2.56.4-158.el8_6.5 – < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- unaffected 0:2.56.4-165.el8_8 – < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- unaffected 0:2.56.4-165.el8_8 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:2.68.4-18.el9_7.2 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:2.68.4-19.el9_8.1 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:2.68.4-18.el9_7.2 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:2.68.4-19.el9_8.1 – < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- unaffected 0:2.68.4-5.el9_0.5 – < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- unaffected 0:2.68.4-7.el9_2.5 – < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support
- unaffected 0:2.68.4-14.el9_4.6 – < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support
- unaffected 0:2.68.4-16.el9_6.5 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17
- unaffected 1791371080 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17
- unaffected 1791371069 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17
- unaffected 1791788287 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.17
- unaffected 1791970484 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18
- unaffected 1791459707 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18
- unaffected 1791459711 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18
- unaffected 1791459759 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18
- unaffected 1789029076 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18
- unaffected 1791966259 – < *
Red Hat · Cert Manager support for Red Hat OpenShift release 1.20
- unaffected 1790598593 – < *
Red Hat · Red Hat AI Inference Server 3.2
- unaffected 1780681984 – < *
Red Hat · Red Hat Discovery 2
- unaffected 1782159791 – < *
Red Hat · Red Hat Discovery 2
- unaffected 1782166952 – < *
Red Hat · Red Hat Hardened Images
- unaffected 2.88.0-1.1.hum1 – < *
Red Hat · Red Hat Insights proxy 1.5
- unaffected 1780420428 – < *
Red Hat · Red Hat OpenShift AI 3.4
- unaffected 1790703542 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1779798159 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1779798164 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1779798165 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1779798222 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1787241211 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1787135742 – < *
Red Hat · Red Hat Update Infrastructure 5
- unaffected 1787241260 – < *
Red Hat · Red Hat Enterprise Linux 10
All versions: affected
Red Hat · Red Hat Enterprise Linux 6
All versions: unknown
Red Hat · Red Hat Enterprise Linux 7
All versions: affected
Red Hat · Red Hat Enterprise Linux 8
All versions: affected
Red Hat · Red Hat Enterprise Linux 9
All versions: affected
Red Hat · Red Hat OpenShift Container Platform 4
All versions: unknown
Red Hat · Red Hat OpenShift Container Platform 4
All versions: affected
Red Hat · Red Hat OpenShift Container Platform 4
All versions: affected

What to do

Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

References (31)

RHSA-2026:15953 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:15969 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:15971 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19148 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19361 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19452 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19457 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19459 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19460 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19523 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19524 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19565 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:19567 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:21275 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:22634 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:25096 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:29197 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:58981 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:72502 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:7461 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:74674 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82304 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82322 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82347 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82354 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82372 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82857 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
RHSA-2026:82888 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14512 (opens in a new tab)vdb-entryx_refsource_REDHAT
RHBZ#2421339 (opens in a new tab)issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/glib/-/issues/3845 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-14512](https://trackcve.app/badge/CVE-2025-14512.svg)](https://trackcve.app/cve/CVE-2025-14512)

Record last updated 5 Nov 2026, 14:18 UTC.