CVE-2025-13601
published 2025-11-26CVE-2025-13601: A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to…
high7.7CVSS 3.1
AVLACLPRNUINSUCNIHAH
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Affected
105 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glib2.0 | < glib2.0 2.74.6-2+deb12u8 (bookworm) | glib2.0 2.74.6-2+deb12u8 (bookworm) |
| gnome | glib | < 2.86.3 | 2.86.3 |
| msrc | azl3_glib_2.78.6-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_glib_2.71.0-7_on_cbl_mariner_2.0 | — | — |
| redhat | ceph_storage | — | — |
| redhat | codeready_linux_builder | — | — |
| redhat | codeready_linux_builder_for_arm64 | — | — |
| redhat | codeready_linux_builder_for_arm64 | — | — |
| redhat | codeready_linux_builder_for_arm64 | — | — |
| redhat | codeready_linux_builder_for_arm64_eus | — | — |
| redhat | codeready_linux_builder_for_arm64_eus | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | codeready_linux_builder_for_power_little_endian_eus | — | — |
| redhat | codeready_linux_builder_for_x86_64 | — | — |
| redhat | codeready_linux_builder_for_x86_64 | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
osv7.7HIGH