CVE-2025-7039: Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()
A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.
Other sources
An integer overflow in glib's temporary directory/file creation allows an out of boundary access, which might be used by an attacker to perform path traversal or access to private content of a temporary file by creating symbolic links which an affected application would follow.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7039?
CVE-2025-7039 is considered a high-severity vulnerability due to its potential for path traversal and unauthorized access to sensitive data.
How do I fix CVE-2025-7039?
To fix CVE-2025-7039, you should update to the latest version of Gnome GLib that has removed the integer overflow vulnerability.
Who is affected by CVE-2025-7039?
CVE-2025-7039 affects users of Gnome GLib in various applications that rely on it for file handling.
What attacks can be performed due to CVE-2025-7039?
Exploiting CVE-2025-7039 may allow an attacker to perform local path traversal or access private file contents through symbolic links.
Is CVE-2025-7039 a local or remote vulnerability?
CVE-2025-7039 is categorized as a local vulnerability that requires local access to exploit.