CVE-2025-14087: GNOME GLib heap corruption in GVariant parser

CVE-2025-14087 · Severity: medium · CVSS 5.6 · Published 2025-12-10

A vulnerability has been identified in GLib, a fundamental software library used by many Linux applications and the GNOME desktop environment. An attacker could send specially crafted data to an application using this library to cause a system crash or potentially run unauthorized commands. This could lead to service disruptions or unauthorized access to sensitive information on affected systems.

Technologies: Gnome Glib, Red Hat Enterprise Linux 10.0, Red Hat Enterprise Linux 7.0, Red Hat Enterprise Linux 8.0, Red Hat Enterprise Linux 9.0. Vendors: Gnome, Red Hat.

Quick answers

Is CVE-2025-14087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14087 being exploited in the wild.
How severe is CVE-2025-14087?
Medium severity, with a CVSS score of 5.6, published 10 December 2025.
Which products and versions are affected?
Gnome Glib < 2.86.3, versions up to (excluding) 2.86.3.
Is there a fix for CVE-2025-14087?
A patch was published on 2026-05-11: Red Hat released security updates (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14087 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-14087?
Check whether you run Gnome Glib, Red Hat Enterprise Linux 10.0, Red Hat Enterprise Linux 7.0 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer underflow flaw was discovered in the GVariant parser component of GLib (Gnome Lib). The issue is rooted in an integer overflow (CWE-190) that occurs when processing maliciously crafted input strings, leading to heap corruption. A remote attacker can exploit this by providing specially formatted GVariant data to an application that parses it without sufficient validation. Successful exploitation can result in a denial of service (application crash) or potentially arbitrary code execution. Patches have been released by Red Hat for various Enterprise Linux versions, and the issue is addressed in GLib upstream versions 2.86.3 and later.

Affected products

  • GNOME GLib < 2.86.3
  • Red Hat Enterprise Linux 7.0
  • Red Hat Enterprise Linux 8.0
  • Red Hat Enterprise Linux 9.0
  • Red Hat Enterprise Linux 10.0

Timeline

  • 2025-12-10: disclosed: Initial disclosure by Red Hat
  • 2025-12-10: advisory: NVD publication date
  • 2026-05-11: patched: Red Hat released security updates (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.