# CVE-2025-14512: GNOME GLib heap buffer overflow in GIO escape_byte_string

Source: https://junglewise.ai/threats/cve-2025-14512-gnome-glib-heap-buffer-overflow-in-gio-escape-byte-string  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-11. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-14512 · Severity: medium · CVSS 6.5 · Published 2025-12-11

A vulnerability has been identified in GLib, a fundamental software library used by many Linux applications and the GNOME desktop environment. An attacker could exploit this flaw by providing specially crafted file or filesystem information, potentially causing applications to crash or behave unexpectedly. This could lead to a denial-of-service, impacting the availability of affected systems and services.

Technologies: [Gnome Glib](https://junglewise.ai/threats/technologies/glib), [Red Hat Enterprise Linux 10.0](https://junglewise.ai/threats/technologies/enterprise-linux-10-0), [Red Hat Enterprise Linux 8.0](https://junglewise.ai/threats/technologies/enterprise-linux-8-0), [Red Hat Enterprise Linux 9.0](https://junglewise.ai/threats/technologies/enterprise-linux-9-0). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-14512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14512 being exploited in the wild.

**How severe is CVE-2025-14512?** Medium severity, with a CVSS score of 6.5, published 11 December 2025.

**Which products and versions are affected?** Gnome Glib up to (excluding) 2.86.3.

**Is there a fix for CVE-2025-14512?** A patch was published on 2026-05-11: Red Hat released security updates (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14512 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-14512?** Check whether you run Gnome Glib, Red Hat Enterprise Linux 10.0, Red Hat Enterprise Linux 8.0 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability (CWE-190) exists in the escape_byte_string() function within GLib's GIO (GLib Input/Output) library. The flaw is triggered when the library processes malicious file or remote filesystem attribute values. This overflow can lead to a heap-based buffer overflow, allowing an attacker to cause a denial-of-service (DoS) via application crashes. While the attack vector is listed as network-based, it typically requires some level of user interaction, such as a user viewing a malicious file or connecting to a compromised remote filesystem. Patches have been released by Red Hat for various Enterprise Linux versions, and GNOME has addressed the issue in GLib versions 2.86.3 and later.

## Affected products

- GNOME glib2 up to (excluding) 2.86.3
- Red Hat Enterprise Linux 7.0, 8.0, 9.0, 10.0
- Red Hat OpenShift 4.0

## Timeline

- 2025-12-11: disclosed: Initial disclosure by Red Hat
- 2025-12-11: advisory: NVD published date
- 2026-05-11: patched: Red Hat released security updates (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971)

## References

- [https://access.redhat.com/errata/RHSA-2026:15953](https://access.redhat.com/errata/RHSA-2026:15953)
- [https://access.redhat.com/errata/RHSA-2026:15969](https://access.redhat.com/errata/RHSA-2026:15969)
- [https://access.redhat.com/errata/RHSA-2026:15971](https://access.redhat.com/errata/RHSA-2026:15971)
- [https://access.redhat.com/errata/RHSA-2026:19148](https://access.redhat.com/errata/RHSA-2026:19148)
- [https://access.redhat.com/errata/RHSA-2026:7461](https://access.redhat.com/errata/RHSA-2026:7461)
- [https://access.redhat.com/security/cve/CVE-2025-14512](https://access.redhat.com/security/cve/CVE-2025-14512)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2421339](https://bugzilla.redhat.com/show_bug.cgi?id=2421339)

## Related threats

- [GNOME GLib denial of service in GDBus authentication](https://junglewise.ai/threats/cve-2026-15588-gnome-glib-denial-of-service-in-gdbus-authentication)
- [GNOME GLib out-of-bounds read in D-Bus introspection XML parsing](https://junglewise.ai/threats/cve-2026-58016-gnome-glib-out-of-bounds-read-in-d-bus-introspection-xml-parsing)
- [GLib path traversal in GDBus DBUS_COOKIE_SHA1 authentication](https://junglewise.ai/threats/cve-2026-58015-glib-path-traversal-in-gdbus-dbus-cookie-sha1-authentication)
- [GNOME GLib off-by-one error in g_key_file_get_locale_string_list](https://junglewise.ai/threats/cve-2026-58014-gnome-glib-off-by-one-error-in-g-key-file-get-locale-string-list)
- [GNOME GLib buffer over-read in g_io_channel_read_line_backend](https://junglewise.ai/threats/cve-2026-58013-gnome-glib-buffer-over-read-in-g-io-channel-read-line-backend)