Read the docs
TI-2019-15218 Aliases CVE-2019-25085GHSA-362p-jc7p-cx87

GNOME gvdb gvdb-builder.c gvdb_table_write_contents_async use after free

Priority MEDIUM 40CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The name of the patch is d83587b2a364eb9a9a53be7e6a708074e252de14. It is recommended to apply a patch to fix this issue. The identifier VDB-216789 was assigned to this vulnerability.

Why it matters now

EPSS 0.00817 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNOMEgvdball versions—No fix listedCNA
  • gvdb VendorGNOME Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnome:gvariant_database:*:*:*:*:*:*:*:*before 2019-06-27VulnerableGNOME
  • cpe:2.3:a:gnome:gvariant_database:*:*:*:*:*:*:*:* Versions before 2019-06-27 Vulnerable ·GNOME

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25085
  2. 2026-10-03 Alias added: GHSA-362p-jc7p-cx87
  3. 2026-10-26 Priority changed: LOW → MEDIUM

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences