Heap Corruption Vulnerability in GLib by Red Hat
CVE-2025-14087

5.6MEDIUM

Key Information:

Vendor

Gnome
Status
Glib
Red Hat Hardened Images
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Vendor
CVE Published:
10 December 2025

What is CVE-2025-14087?

A flaw exists in GLib (Gnome Lib) that enables a remote attacker to exploit a heap corruption issue. The vulnerability arises within the GVariant parser when parsing maliciously crafted input strings. This flaw can lead to a denial of service or even a potential remote code execution, depending on the attacker's ability to manipulate the input data to trigger buffer-underflow conditions.

Affected Version(s)

glib 0 < 2.86.3

Red Hat Hardened Images 2.88.0-1.1.hum1

References

https://access.redhat.com/errata/RHSA-2026:7461
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-14087
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2419093
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Sovereign Tech Resilience program (Sovereign Tech Agency) and treeplus for reporting this issue.
.