Heap Buffer Overread Vulnerability in util-linux by Red Hat
CVE-2025-14104

6.1MEDIUM

Key Information:

Vendor

Util-linux

Status
Util-linux
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
5 December 2025

What is CVE-2025-14104?

A vulnerability exists in the util-linux package, specifically within the setpwnam() function. This flaw allows for a heap buffer overread when processing usernames that are 256 bytes long. It affects the SUID (Set User ID) login-utils utilities that interact with the password database, potentially exposing sensitive information and posing a risk to system integrity.

Affected Version(s)

Cert Manager support for Red Hat OpenShift release 1.18 1791459707

Cert Manager support for Red Hat OpenShift release 1.18 1791459711

Cert Manager support for Red Hat OpenShift release 1.18 1791459759

References

https://access.redhat.com/errata/RHSA-2026:1696
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:1852
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:1913
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.