Is CVE-2025-13601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13601 being exploited in the wild.

How severe is CVE-2025-13601?

High severity, with a CVSS score of 7.7, published 26 November 2025.

Which products and versions are affected?

Gnome Glib through 2.80.4; Red Hat Enterprise Linux 10 glib2-2.80.4-10.el10_1.12; Red Hat Enterprise Linux 9 glib2-2.68.4-18.el9_7.1.

Is there a fix for CVE-2025-13601?

A patch was published on 2026-01-21: Red Hat released updates for RHEL 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-13601 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-13601?

Check whether you run Gnome Glib, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13601: GNOME GLib heap buffer overflow in g_escape_uri_string

CVE-2025-13601 · Severity: high · CVSS 7.7 · Published 2025-11-26

A security vulnerability has been identified in GLib, a fundamental software library used by many Linux applications and the GNOME desktop environment. The flaw occurs when the library processes specially crafted web addresses (URIs), potentially causing an application to crash or behave unpredictably. This could allow a local attacker to disrupt system operations or interfere with data integrity on affected Linux systems.

Technologies: Gnome Glib, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Gnome, Red Hat.

Quick answers

Is CVE-2025-13601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13601 being exploited in the wild.
How severe is CVE-2025-13601?: High severity, with a CVSS score of 7.7, published 26 November 2025.
Which products and versions are affected?: Gnome Glib through 2.80.4; Red Hat Enterprise Linux 10 glib2-2.80.4-10.el10_1.12; Red Hat Enterprise Linux 9 glib2-2.68.4-18.el9_7.1.
Is there a fix for CVE-2025-13601?: A patch was published on 2026-01-21: Red Hat released updates for RHEL 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13601 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-13601?: Check whether you run Gnome Glib, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in GLib's g_escape_uri_string() function due to an integer overflow during buffer size calculation. When a string containing a high volume of characters requiring escaping is processed, the calculated length for the new buffer can wrap around, resulting in an undersized allocation. Subsequent writing of the escaped string leads to an out-of-bounds write on the heap. This vulnerability can be triggered locally and may result in a denial of service or data corruption. Patches have been released by Red Hat for Enterprise Linux 9 and 10, and upstream fixes are available in the GNOME GLib repository.

Affected products

GNOME glib2 through 2.80.4
Red Hat Enterprise Linux 9 glib2-2.68.4-18.el9_7.1
Red Hat Enterprise Linux 10 glib2-2.80.4-10.el10_1.12

Timeline

2025-11-26: advisory: Initial NVD publication
2026-01-21: patched: Red Hat released updates for RHEL 9
2026-01-22: patched: Red Hat released updates for RHEL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.