BaseFortify

Publication date: 2025-12-05

Last updated on: 2026-06-30

Assigner: Red Hat, Inc.

Description

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-05

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2025-12-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14104

Affected Vendors & Products

Vendor	Product	Version / Range
util-linux	util-linux	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in util-linux where a heap buffer overread occurs when processing 256-byte usernames in the setpwnam() function. It affects SUID login-utils utilities that write to the password database.

Impact Analysis

The vulnerability can lead to a heap buffer overread, which may cause a denial of service (crash) or potentially expose sensitive memory contents due to improper handling of long usernames in privileged utilities.

Hi! I’m here to help you understand CVE-2025-14104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70