Bug 2419093 (CVE-2025-14087)

Summary:	CVE-2025-14087 glib: GLib: Buffer underflow in GVariant parser leads to heap corruption
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kshier, lmigso, rhel-process-autobot, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2419097, 2419098, 2419099, 2419100, 2419101, 2419102, 2419103, 2419104, 2419105, 2419106, 2419107, 2419108, 2419109, 2419111, 2419112, 2419113, 2419114, 2419115, 2419116, 2419117, 2419118, 2419119, 2419120, 2419121, 2419122, 2419123, 2419124, 2419125, 2419126, 2419127, 2419128, 2419129, 2419130, 2419131, 2419132, 2419133, 2419134
Bug Blocks:

Description OSIDB Bzimport 2025-12-05 08:44:36 UTC

A buffer-underflow vulnerability exists in GLib’s GVariant parser, specifically within bytestring_parse() and string_parse(). The parser uses signed 32-bit integers (gint) as loop indices (i and j). When extremely large strings are parsed, these counters overflow into negative values, causing the parser to write to memory before the start of the allocated buffer (str[j++]). This results in a classic out-of-bounds write condition. Because GVariant parsing is often performed on attacker-influenced data, a remote attacker can trigger heap corruption, causing a crash or potentially achieving code execution. This flaw has been confirmed by maintainers and patched upstream.

Comment 1 lmigso 2026-02-11 09:26:01 UTC

The current state per RHEL's advisory for CVE-2025-14087 is Fix Deferred. Is there an ETA for when this will be patched, particularly as the CVE has been rated by NVD as Critical.

Comment 2 errata-xmlrpc 2026-05-11 09:54:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:15953 https://access.redhat.com/errata/RHSA-2026:15953

Comment 3 errata-xmlrpc 2026-05-11 11:44:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:15971 https://access.redhat.com/errata/RHSA-2026:15971

Comment 4 errata-xmlrpc 2026-05-11 21:40:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:15969 https://access.redhat.com/errata/RHSA-2026:15969

Comment 10 errata-xmlrpc 2026-05-19 16:09:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19148 https://access.redhat.com/errata/RHSA-2026:19148

Comment 11 errata-xmlrpc 2026-05-19 21:40:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19361 https://access.redhat.com/errata/RHSA-2026:19361

Comment 12 errata-xmlrpc 2026-05-20 01:54:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:19459 https://access.redhat.com/errata/RHSA-2026:19459

Comment 13 errata-xmlrpc 2026-05-20 02:06:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:19452 https://access.redhat.com/errata/RHSA-2026:19452

Comment 14 errata-xmlrpc 2026-05-20 02:40:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:19460 https://access.redhat.com/errata/RHSA-2026:19460

Comment 15 errata-xmlrpc 2026-05-20 03:52:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:19457 https://access.redhat.com/errata/RHSA-2026:19457

Comment 16 errata-xmlrpc 2026-05-20 04:40:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:19523 https://access.redhat.com/errata/RHSA-2026:19523

Comment 17 errata-xmlrpc 2026-05-20 04:43:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:19524 https://access.redhat.com/errata/RHSA-2026:19524

Comment 18 errata-xmlrpc 2026-05-20 09:39:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:19565 https://access.redhat.com/errata/RHSA-2026:19565

Comment 19 errata-xmlrpc 2026-05-20 09:49:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:19566 https://access.redhat.com/errata/RHSA-2026:19566

Comment 20 errata-xmlrpc 2026-05-20 09:55:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:19567 https://access.redhat.com/errata/RHSA-2026:19567