Vulnerability · Published Jun 13, 2025 · Assigned by redhat
CVE-2025-6052Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring
Low 3.7
In plain English
A low-severity integer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | glib2.0 | 2.84.3-1 | DEBIAN-CVE-2025-6052 |
| Debian:14 | glib2.0 | 2.84.3-1 | DEBIAN-CVE-2025-6052 |
| Ubuntu:22.04:LTS | glib2.0 | 2.72.4-0ubuntu2.7 | USN-7942-1 |
| Ubuntu:24.04:LTS | glib2.0 | 2.80.0-6ubuntu3.6 | USN-7942-1 |
| Ubuntu:24.04:LTS | glib2.0 | 2.80.0-6ubuntu3.6 | UBUNTU-CVE-2025-6052 |
| Ubuntu:25.10 | glib2.0 | 2.86.0-2ubuntu0.1 | USN-7942-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2025-6052 vdb-entry, x_refsource_REDHAT
- RHBZ#2372666 issue-tracking, x_refsource_REDHAT
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html