# CVE-2025-14087: GNOME GLib heap corruption in GVariant parser

Source: https://junglewise.ai/threats/cve-2025-14087-gnome-glib-heap-corruption-in-gvariant-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-14087 · Severity: medium · CVSS 5.6 · Published 2025-12-10

A vulnerability has been identified in GLib, a fundamental software library used by many Linux applications and the GNOME desktop environment. An attacker could send specially crafted data to an application using this library to cause a system crash or potentially run unauthorized commands. This could lead to service disruptions or unauthorized access to sensitive information on affected systems.

Technologies: [Gnome Glib](https://junglewise.ai/threats/technologies/glib), [Red Hat Enterprise Linux 10.0](https://junglewise.ai/threats/technologies/enterprise-linux-10-0), [Red Hat Enterprise Linux 7.0](https://junglewise.ai/threats/technologies/enterprise-linux-7-0), [Red Hat Enterprise Linux 8.0](https://junglewise.ai/threats/technologies/enterprise-linux-8-0), [Red Hat Enterprise Linux 9.0](https://junglewise.ai/threats/technologies/enterprise-linux-9-0). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-14087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14087 being exploited in the wild.

**How severe is CVE-2025-14087?** Medium severity, with a CVSS score of 5.6, published 10 December 2025.

**Which products and versions are affected?** Gnome Glib < 2.86.3, versions up to (excluding) 2.86.3.

**Is there a fix for CVE-2025-14087?** A patch was published on 2026-05-11: Red Hat released security updates (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14087 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-14087?** Check whether you run Gnome Glib, Red Hat Enterprise Linux 10.0, Red Hat Enterprise Linux 7.0 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer underflow flaw was discovered in the GVariant parser component of GLib (Gnome Lib). The issue is rooted in an integer overflow (CWE-190) that occurs when processing maliciously crafted input strings, leading to heap corruption. A remote attacker can exploit this by providing specially formatted GVariant data to an application that parses it without sufficient validation. Successful exploitation can result in a denial of service (application crash) or potentially arbitrary code execution. Patches have been released by Red Hat for various Enterprise Linux versions, and the issue is addressed in GLib upstream versions 2.86.3 and later.

## Affected products

- GNOME GLib < 2.86.3
- Red Hat Enterprise Linux 7.0
- Red Hat Enterprise Linux 8.0
- Red Hat Enterprise Linux 9.0
- Red Hat Enterprise Linux 10.0

## Timeline

- 2025-12-10: disclosed: Initial disclosure by Red Hat
- 2025-12-10: advisory: NVD publication date
- 2026-05-11: patched: Red Hat released security updates (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971)

## References

- [https://access.redhat.com/errata/RHSA-2026:15953](https://access.redhat.com/errata/RHSA-2026:15953)
- [https://access.redhat.com/errata/RHSA-2026:15969](https://access.redhat.com/errata/RHSA-2026:15969)
- [https://access.redhat.com/errata/RHSA-2026:15971](https://access.redhat.com/errata/RHSA-2026:15971)
- [https://access.redhat.com/errata/RHSA-2026:19148](https://access.redhat.com/errata/RHSA-2026:19148)
- [https://access.redhat.com/errata/RHSA-2026:7461](https://access.redhat.com/errata/RHSA-2026:7461)
- [https://access.redhat.com/security/cve/CVE-2025-14087](https://access.redhat.com/security/cve/CVE-2025-14087)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2419093](https://bugzilla.redhat.com/show_bug.cgi?id=2419093)

## Related threats

- [GNOME GLib denial of service in GDBus authentication](https://junglewise.ai/threats/cve-2026-15588-gnome-glib-denial-of-service-in-gdbus-authentication)
- [GNOME GLib out-of-bounds read in D-Bus introspection XML parsing](https://junglewise.ai/threats/cve-2026-58016-gnome-glib-out-of-bounds-read-in-d-bus-introspection-xml-parsing)
- [GLib path traversal in GDBus DBUS_COOKIE_SHA1 authentication](https://junglewise.ai/threats/cve-2026-58015-glib-path-traversal-in-gdbus-dbus-cookie-sha1-authentication)
- [GNOME GLib off-by-one error in g_key_file_get_locale_string_list](https://junglewise.ai/threats/cve-2026-58014-gnome-glib-off-by-one-error-in-g-key-file-get-locale-string-list)
- [GNOME GLib buffer over-read in g_io_channel_read_line_backend](https://junglewise.ai/threats/cve-2026-58013-gnome-glib-buffer-over-read-in-g-io-channel-read-line-backend)