Executive brief
A vulnerability exists in GLib, a widely used low-level software library, specifically within its Base64 encoding functionality. If an application uses this library to process extremely large amounts of data (gigabytes in size) provided by a user, it could lead to a system crash or unpredictable behavior. This could potentially be used by an attacker to disrupt services or, in complex scenarios, gain unauthorized access to memory.
Technical details
An integer overflow leading to a buffer underflow exists in GLib's g_base64_encode() function. The vulnerability is caused by storing the output length returned by g_base64_encode_step() in a signed integer (gint) instead of a size_t (gsize). When encoding attacker-controlled input of approximately 2GB or more, the signed integer overflows and becomes negative. This negative value is subsequently used in pointer arithmetic within g_base64_encode_close(), resulting in a heap-based out-of-bounds write. An attacker can exploit this to cause a denial of service (crash) or potentially achieve memory corruption. The issue was identified in glib/gbase64.c and affects versions up to 2.87.0.
Affected products
- GNOME GLib through 2.87.0
- Siemens SINEC OS before V4.0
- Siemens RUGGEDCOM RST2428P before V4.0
Timeline
- 2025-12-16: disclosed: Reported to GNOME via YesWeHack
- 2026-01-27: advisory: Initial CVE publication and Red Hat advisory
- 2026-06-02: patched: Siemens released SINEC OS V4.0 addressing the issue in industrial products