Is CVE-2025-7039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7039 being exploited in the wild.

How severe is CVE-2025-7039?

Low severity, with a CVSS score of 3.7, published 3 September 2025.

Which products and versions are affected?

Gnome Glib through 2.82.x; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

Is there a fix for CVE-2025-7039?

A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 to address the issue in affected industrial products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-7039 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-7039?

Check whether you run Gnome Glib, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7039: GLib integer overflow in temporary file creation

CVE-2025-7039 · Severity: low · CVSS 3.7 · Published 2025-09-03

A security flaw exists in GLib, a fundamental software library used by many Linux-based applications and systems to handle basic tasks like file management. An error in how the library creates temporary files could allow an attacker to manipulate file paths or access private data they should not be able to see. This could lead to unauthorized data access or system instability in environments that rely on this library, such as Siemens industrial networking equipment.

Technologies: Gnome Glib, Siemens RUGGEDCOM RST2428P, Siemens SINEC OS. Vendors: Gnome, Siemens.

Quick answers

Is CVE-2025-7039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7039 being exploited in the wild.
How severe is CVE-2025-7039?: Low severity, with a CVSS score of 3.7, published 3 September 2025.
Which products and versions are affected?: Gnome Glib through 2.82.x; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.
Is there a fix for CVE-2025-7039?: A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 to address the issue in affected industrial products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7039 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-7039?: Check whether you run Gnome Glib, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in GLib's `get_tmp_file()` function within `glib/gfileutils.c`. The flaw is caused by insufficient validation of file path lengths during the creation of temporary directories or files. This overflow leads to an out-of-bounds memory access (specifically a buffer under-read), which can be exploited to perform path traversal or access the private content of temporary files by tricking the application into following malicious symbolic links. While the attack vector is listed as network-based in some metrics, it typically requires specific conditions where an application processes untrusted path-related input. Siemens has confirmed impact on SINEC OS-based devices like the RUGGEDCOM RST2428P and recommends upgrading to SINEC OS V4.0.

Affected products

GNOME glib through 2.82.x
Siemens SINEC OS before V4.0
Siemens RUGGEDCOM RST2428P before V4.0

Timeline

2025-09-01: disclosed: Initial report in Red Hat Bugzilla
2025-09-03: advisory: NVD publication date
2026-06-02: patched: Siemens released SINEC OS V4.0 to address the issue in affected industrial products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.