Log in Start free

Vulnerability · Published Sep 3, 2025 · Assigned by redhat

CVE-2025-7039Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()

Low 3.7

In plain English

A low-severity path traversal in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 62.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glib2.02.74.6-2+deb12u7DEBIAN-CVE-2025-7039
Debian:13glib2.02.84.4-3~deb13u1DEBIAN-CVE-2025-7039
Debian:14glib2.02.84.4-1DEBIAN-CVE-2025-7039
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.7USN-7942-1
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.7UBUNTU-CVE-2025-7039
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.6USN-7942-1
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.6UBUNTU-CVE-2025-7039
Ubuntu:25.10glib2.02.86.0-2ubuntu0.1USN-7942-1

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References