CVE-2025-14512
BaseFortify
Publication date: 2025-12-11
Last updated on: 2026-04-19
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnome | glib | to 2.86.3 (inc) |
| redhat | enterprise_linux | 7.0 |
| redhat | openshift | 4.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| glib | glib | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update GLib to a version that includes the fix for CVE-2025-14512. Avoid processing untrusted or malicious file or remote filesystem attribute values that could trigger the integer overflow in the escape_byte_string() function. Monitoring for process crashes related to GLib's GIO component may also help identify exploitation attempts. [1]
Can you explain this vulnerability to me?
This vulnerability is a flaw in the GLib library's GIO escape_byte_string() function. It involves an integer overflow that leads to a heap buffer overflow when processing malicious file or remote filesystem attribute values. This can cause the program to crash or behave unexpectedly.
How can this vulnerability impact me? :
The vulnerability can lead to a denial-of-service (DoS) condition by causing a heap buffer overflow, which may crash applications using the affected GLib function. This could disrupt services or applications relying on GLib for input/output operations.