Is CVE-2025-60018 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60018 being exploited in the wild.

How severe is CVE-2025-60018?

Medium severity, with a CVSS score of 4.8, published 25 September 2025.

Which products and versions are affected?

Gnome Glib-Networking 2.60 to 2.80.1.

Is there a fix for CVE-2025-60018?

A patch was published on 2025-08-05: Fix merged in version 2.80.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-60018 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-60018?

Check whether you run Gnome Glib-Networking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60018: GNOME glib-networking out of bounds read in OpenSSL backend

CVE-2025-60018 · Severity: medium · CVSS 4.8 · Published 2025-09-25

A security vulnerability exists in glib-networking, a library used by many Linux applications to handle secure network connections. When using the OpenSSL backend to process security certificates, the software may fail to properly terminate data strings, leading to memory errors. This could allow an attacker to cause an application to crash or potentially expose small amounts of sensitive memory during secure connection attempts.

Technologies: Gnome Glib-Networking. Vendors: Gnome.

Quick answers

Is CVE-2025-60018 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60018 being exploited in the wild.
How severe is CVE-2025-60018?: Medium severity, with a CVSS score of 4.8, published 25 September 2025.
Which products and versions are affected?: Gnome Glib-Networking 2.60 to 2.80.1.
Is there a fix for CVE-2025-60018?: A patch was published on 2025-08-05: Fix merged in version 2.80.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-60018 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-60018?: Check whether you run Gnome Glib-Networking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in glib-networking's OpenSSL backend within the g_tls_certificate_openssl_get_property() function. The code incorrectly validates the return value of BIO_write() when attempting to append a null terminator to a PEM-encoded certificate; specifically, it uses logical negation on the return value, which fails to catch error codes like -1 or -2. If BIO_write() fails (e.g., due to memory pressure), the code proceeds to call g_value_set_string(), which triggers a strlen() on an unterminated buffer. This results in an out-of-bounds read that can lead to a process crash (DoS) or the leakage of adjacent memory contents. The vulnerability is fixed in version 2.80.2.

Affected products

GNOME glib-networking 2.60 to 2.80.1

Timeline

2025-06-29: disclosed: Reported via YesWeHack
2025-08-05: patched: Fix merged in version 2.80.2
2025-09-25: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.