CVE-2025-6052

A flaw was found in how GLibs GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesnt. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
redhatCNA
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
gnomeglib
2.75.3 ≤
𝑥
≤ 2.84.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
glib2.0
bullseye
2.66.8-1+deb11u4
not-affected
bookworm
2.74.6-2+deb12u7
not-affected
bullseye (security)
2.66.8-1+deb11u6
fixed
bookworm (security)
2.74.6-2+deb12u2
fixed
trixie
2.84.4-3~deb13u1
fixed
forky
2.84.4-3
fixed
sid
2.84.4-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glib2.0
plucky
needed
oracular
ignored
noble
needed
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
trusty
not-affected