CVE-2025-14087

EUVD-2025-202405
A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.6 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
redhatCNA
5.6 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
gnomeglib
𝑥
< 2.86.3
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
glib2.0
bookworm
2.74.6-2+deb12u8
fixed
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
2.66.8-1+deb11u7
fixed
forky
2.87.2-3
fixed
sid
2.87.2-3
fixed
trixie
2.84.4-3~deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glib2.0
bionic
Fixed 2.56.4-0ubuntu0.18.04.9+esm5
released
focal
Fixed 2.64.6-1~ubuntu20.04.9+esm1
released
jammy
Fixed 2.72.4-0ubuntu2.7
released
noble
Fixed 2.80.0-6ubuntu3.6
released
plucky
Fixed 2.84.1-1ubuntu0.2
released
questing
Fixed 2.86.0-2ubuntu0.1
released
trusty
Fixed 2.40.2-0ubuntu1.1+esm7
released
xenial
Fixed 2.48.2-0ubuntu4.8+esm5
released
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2025-14087
https://bugzilla.redhat.com/show_bug.cgi?id=2419093