CVE-2025-6052

EUVD-2025-18285
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
redhatCNA
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
Affected Products (NVD)
VendorProductVersion
gnomeglib
2.75.3 ≤
𝑥
≤ 2.84.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
glib2.0
bookworm
2.74.6-2+deb12u8
not-affected
bookworm (security)
2.74.6-2+deb12u2
fixed
bullseye
2.66.8-1+deb11u4
not-affected
bullseye (security)
2.66.8-1+deb11u7
fixed
forky
2.87.2-3
fixed
sid
2.87.2-3
fixed
trixie
2.84.4-3~deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glib2.0
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
Fixed 2.80.0-6ubuntu3.6
released
oracular
ignored
plucky
Fixed 2.84.1-1ubuntu0.2
released
questing
not-affected
trusty
not-affected
xenial
not-affected