CVE-2025-14104: util-linux heap buffer overread in setpwnam function

CVE-2025-14104 · Severity: medium · CVSS 6.1 · Published 2025-12-05

A security vulnerability has been identified in util-linux, a core set of tools used by Linux operating systems for basic tasks like logging in and managing disks. An attacker with local access to a system could exploit this flaw to cause a system crash or potentially access restricted memory. This could disrupt operations or lead to a denial of service on affected servers and workstations.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2025-14104 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14104 being exploited in the wild.
How severe is CVE-2025-14104?
Medium severity, with a CVSS score of 6.1, published 5 December 2025.
Which products and versions are affected?
Red Hat Enterprise Linux 10 < 2.40.2-15.el10_1; Red Hat Enterprise Linux 8 < 2.32.1-48.el8_10; Red Hat Enterprise Linux 9 < 2.37.4-21.el9_7.
Is there a fix for CVE-2025-14104?
A patch was published on 2026-02-02: Red Hat released patches for RHEL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14104 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-14104?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overread vulnerability (CWE-125) exists in the util-linux package within the setpwnam() function. The flaw is triggered when the utility processes specially crafted 256-byte usernames while writing to the password database. This affects SUID (Set User ID) login-utils, which run with elevated privileges. A local, authenticated attacker can exploit this to read sensitive information from heap memory or cause a denial of service (crash). The issue is addressed in util-linux version 2.41.3 and various Red Hat Enterprise Linux package updates.

Affected products

  • util-linux util-linux < 2.41.3
  • Red Hat Red Hat Enterprise Linux 8 < 2.32.1-48.el8_10
  • Red Hat Red Hat Enterprise Linux 9 < 2.37.4-21.el9_7
  • Red Hat Red Hat Enterprise Linux 10 < 2.40.2-15.el10_1

Timeline

  • 2025-12-05: advisory: Initial NVD publication date
  • 2026-02-02: patched: Red Hat released patches for RHEL 10
  • 2026-02-03: patched: Red Hat released patches for RHEL 8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.