CVE-2025-6052

A flaw was found in how GLibs GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesnt. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
redhatCNA
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
Debian logo
Debian Releases
Debian Product
Codename
glib2.0
bullseye
2.66.8-1+deb11u4
not-affected
bookworm
2.74.6-2+deb12u6
not-affected
bullseye (security)
2.66.8-1+deb11u6
fixed
bookworm (security)
2.74.6-2+deb12u2
fixed
trixie
2.84.3-1
fixed
sid
2.84.3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glib2.0
plucky
needed
oracular
ignored
noble
needed
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
trusty
not-affected