Heap Corruption Vulnerability in GLib by Red Hat
CVE-2025-14087

5.6MEDIUM

Key Information:

Vendor

Gnome
Status
Glib
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Vendor
CVE Published:
10 December 2025

What is CVE-2025-14087?

A flaw exists in GLib (Gnome Lib) that enables a remote attacker to exploit a heap corruption issue. The vulnerability arises within the GVariant parser when parsing maliciously crafted input strings. This flaw can lead to a denial of service or even a potential remote code execution, depending on the attacker's ability to manipulate the input data to trigger buffer-underflow conditions.

Affected Version(s)

Cert Manager support for Red Hat OpenShift release 1.17 1791371080

Cert Manager support for Red Hat OpenShift release 1.17 1791371069

Cert Manager support for Red Hat OpenShift release 1.17 1791788287

References

https://access.redhat.com/errata/RHSA-2026:15953
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15969
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15971
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Sovereign Tech Resilience program (Sovereign Tech Agency) and treeplus for reporting this issue.
.