CVE-2025-14512: Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escapebytestring() function when processing malicious file or remote filesystem attribute values.
Other sources
Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
— Microsoft
This vulnerability stems from an integer overflow in GLib’s GIO escapebytestring() function, where the count of invalid characters is multiplied using a signed integer, resulting in a too-small memory allocation for escaped output. When a malicious file or remote filesystem supplies attribute values with a large number of invalid bytes, the subsequent escaping loop writes beyond the allocated buffer, triggering a heap buffer overflow and crashing the process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14512?
CVE-2025-14512 has been classified as a high severity vulnerability due to the potential for heap buffer overflow and denial-of-service.
How do I fix CVE-2025-14512?
To mitigate CVE-2025-14512, update GLib to the latest version that addresses this vulnerability.
What systems are affected by CVE-2025-14512?
CVE-2025-14512 affects systems that utilize GLib's GIO module, particularly those dealing with file or remote filesystem attributes.
What happens if CVE-2025-14512 is exploited?
Exploiting CVE-2025-14512 can lead to a denial-of-service condition, causing affected applications to crash or become unresponsive.
How can I determine if my system is vulnerable to CVE-2025-14512?
You can determine vulnerability to CVE-2025-14512 by checking the version of GLib installed on your system and comparing it with the fixed versions.