Description
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected products
- GNOME / GLib2.86.3
- RedHat / ceph_storage8.0 – 8.0
- RedHat / codeready_linux_builder9.0 – 9.0
- RedHat / codeready_linux_builder_for_arm6410.0 – 10.0
- RedHat / codeready_linux_builder_for_arm649.6 – 9.6
- RedHat / codeready_linux_builder_for_arm648.0 – 8.0
- RedHat / codeready_linux_builder_for_arm64_eus10.0 – 10.0
- RedHat / codeready_linux_builder_for_arm64_eus9.4 – 9.4
- RedHat / codeready_linux_builder_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems9.4_s390x – 9.4_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems9.6_s390x – 9.6_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems10.0_s390x – 10.0_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems8.0_s390x – 8.0_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems_eus10.0_s390x – 10.0_s390x
- RedHat / codeready_linux_builder_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian10.0_ppc64le – 10.0_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian9.6_ppc64le – 9.6_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian9.4_ppc64le – 9.4_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian8.0_ppc64le – 8.0_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian_eus10.0_ppc64le – 10.0_ppc64le
- RedHat / codeready_linux_builder_for_x86_649.6 – 9.6
- RedHat / codeready_linux_builder_for_x86_649.0 – 9.0
- RedHat / codeready_linux_builder_for_x86_649.4 – 9.4
- RedHat / codeready_linux_builder_for_x86_648.0 – 8.0
- RedHat / codeready_linux_builder_for_x86_6410.0 – 10.0
- RedHat / codeready_linux_builder_for_x86_64_eus10.0 – 10.0
- RedHat / discovery2.0 – 2.0
- RedHat / enterprise_linux_for_arm_649.4 – 9.4
- RedHat / enterprise_linux_for_arm_649.6 – 9.6
- RedHat / enterprise_linux_for_arm_6410.0 – 10.0
- RedHat / enterprise_linux_for_arm_648.0 – 8.0
- RedHat / enterprise_linux_for_arm_649.2 – 9.2
- RedHat / enterprise_linux_for_arm_649.0 – 9.0
- RedHat / enterprise_linux_for_arm_64_eus10.0 – 10.0
- RedHat / enterprise_linux_for_ibm_z_systems8.0_s390x – 8.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems10.0_s390x – 10.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems9.2_s390x – 9.2_s390x
- RedHat / enterprise_linux_for_ibm_z_systems9.4_s390x – 9.4_s390x
- RedHat / enterprise_linux_for_ibm_z_systems9.6_s390x – 9.6_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus10.0_s390x – 10.0_s390x
- RedHat / enterprise_linux_for_power_little_endian10.0_ppc64le – 10.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian8.0_ppc64le – 8.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_for_power_little_endian9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus10.0_ppc64le – 10.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_for_x86_649.4 – 9.4
- RedHat / enterprise_linux_for_x86_649.2 – 9.2
- RedHat / enterprise_linux_for_x86_648.0 – 8.0
- RedHat / enterprise_linux_for_x86_6410.0 – 10.0
- RedHat / enterprise_linux_for_x86_649.0 – 9.0
- RedHat / enterprise_linux_for_x86_648.6 – 8.6
- RedHat / enterprise_linux_for_x86_649.6 – 9.6
- RedHat / enterprise_linux_for_x86_648.8 – 8.8
- RedHat / enterprise_linux_for_x86_64_eus8.6 – 8.6
- RedHat / enterprise_linux_for_x86_64_eus9.4 – 9.4
- RedHat / enterprise_linux_for_x86_64_eus10.0 – 10.0
- RedHat / enterprise_linux_for_x86_64_eus9.6 – 9.6
- RedHat / enterprise_linux_for_x86_64_eus8.8 – 8.8
- RedHat / enterprise_linux_for_x86_64_eus8.4 – 8.4
- RedHat / enterprise_linux_server_aus8.6 – 8.6
- RedHat / enterprise_linux_server_aus8.2 – 8.2
- RedHat / enterprise_linux_server_aus8.4 – 8.4
- RedHat / enterprise_linux_server_aus9.6 – 9.6
- RedHat / enterprise_linux_server_aus9.2 – 9.2
- RedHat / enterprise_linux_server_aus9.4 – 9.4
- RedHat / enterprise_linux_server_for_power_little_endian10.0_ppc64le – 10.0_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian8.6_ppc64le – 8.6_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian8.8_ppc64le – 8.8_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_eus9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_server_tus8.6 – 8.6
- RedHat / enterprise_linux_server_tus8.8 – 8.8
- RedHat / openshift_container_platform4.12 – 4.12
- RedHat / openshift_container_platform4.16 – 4.16
- RedHat / openshift_container_platform4.17 – 4.17
- RedHat / openshift_container_platform4.18 – 4.18
- RedHat / openshift_container_platform4.19 – 4.19
- RedHat / openshift_container_platform_for_arm644.12 – 4.12
- RedHat / openshift_container_platform_for_arm644.16 – 4.16
- RedHat / openshift_container_platform_for_arm644.17 – 4.17
- RedHat / openshift_container_platform_for_arm644.18 – 4.18
- RedHat / openshift_container_platform_for_arm644.19 – 4.19
- RedHat / openshift_container_platform_for_ibm_z4.12 – 4.12
- RedHat / openshift_container_platform_for_ibm_z4.16 – 4.16
- RedHat / openshift_container_platform_for_ibm_z4.17 – 4.17
- RedHat / openshift_container_platform_for_ibm_z4.18 – 4.18
- RedHat / openshift_container_platform_for_ibm_z4.19 – 4.19
- RedHat / openshift_container_platform_for_linuxone4.12 – 4.12
- RedHat / openshift_container_platform_for_linuxone4.16 – 4.16
- RedHat / openshift_container_platform_for_linuxone4.17 – 4.17
- RedHat / openshift_container_platform_for_linuxone4.18 – 4.18
- RedHat / openshift_container_platform_for_linuxone4.19 – 4.19
- RedHat / openshift_container_platform_for_power4.12 – 4.12
- RedHat / openshift_container_platform_for_power4.16 – 4.16
- RedHat / openshift_container_platform_for_power4.17 – 4.17
- RedHat / openshift_container_platform_for_power4.19 – 4.19
- RedHat / openshift_container_platform_for_power4.18 – 4.18
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:0936
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:0975
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:0991
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1323
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1324
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1326
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1327
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1465
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1608
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1624
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1625
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1626
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1627
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1652
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:1736
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:18344
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:18705
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2064
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2072
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2485
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2563
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2633
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2659
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2671
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:2974
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:3415
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:4419
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:7461
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2025-13601
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2416741
- MISChttps://gitlab.gnome.org/GNOME/glib/-/issues/3827
- MISChttps://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914
Updated 20m ago · 8 sources