Glib: glib: buffer underflow in gvariant parser leads to heap corruption
Priority MEDIUM 44CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 39 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00826 57th percentileScored 2026-11-07
Fix Partial glib (GNOME): 2.86.3Red Hat: 30 advisoriesRed Hat: 39 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GNOME | glib | before 2.86.3 | 2.86.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 2.80.4-10.el10_1.13 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 2.80.4-12.el10_2.13 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 2.80.4-4.el10_0.9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 2.56.1-12.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 2.70.1-9.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 2.56.4-169.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 2.56.4-10.el8_4.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | 2.56.4-10.el8_4.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 2.56.4-158.el8_6.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 2.56.4-158.el8_6.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 2.56.4-158.el8_6.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 2.56.4-165.el8_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 2.56.4-165.el8_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.68.4-18.el9_7.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.68.4-19.el9_8.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.68.4-18.el9_7.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.68.4-19.el9_8.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 2.68.4-5.el9_0.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 2.68.4-7.el9_2.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 2.68.4-14.el9_4.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | 2.68.4-16.el9_6.5 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791371080 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791371069 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791788287 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791970484 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459707 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459711 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459759 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1789029076 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791966259 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | 1790598593 | Patch available | CNA |
| Red Hat | Red Hat AI Inference Server 3.2 | — | 1780681984 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 1782159791 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 1782166952 | Patch available | CNA |
| Red Hat | Red Hat Hardened Images | — | 2.88.0-1.1.hum1 | Patch available | CNA |
| Red Hat | Red Hat Insights proxy 1.5 | — | 1780420428 | Patch available | CNA |
| Red Hat | Red Hat OpenShift AI 3.4 | — | 1790703542 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798159 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798164 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798165 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798222 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787241211 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787135742 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787241260 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
- glib VendorGNOME Affected before 2.86.3 Fixed in 2.86.3 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 2.80.4-10.el10_1.13 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 2.80.4-12.el10_2.13 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 2.80.4-4.el10_0.9 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 2.56.1-12.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.70.1-9.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.56.4-169.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.56.4-10.el8_4.5 Patch available CNA
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 2.56.4-10.el8_4.5 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 2.56.4-158.el8_6.5 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.56.4-158.el8_6.5 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.56.4-158.el8_6.5 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 2.56.4-165.el8_8 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.56.4-165.el8_8 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.68.4-18.el9_7.2 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.68.4-19.el9_8.1 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.68.4-18.el9_7.2 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.68.4-19.el9_8.1 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.68.4-5.el9_0.5 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 2.68.4-7.el9_2.5 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 2.68.4-14.el9_4.6 Patch available CNA
- Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.68.4-16.el9_6.5 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791371080 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791371069 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791788287 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791970484 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459707 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459711 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459759 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1789029076 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791966259 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.20 VendorRed Hat Affected — Fixed in 1790598593 Patch available CNA
- Red Hat AI Inference Server 3.2 VendorRed Hat Affected — Fixed in 1780681984 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 1782159791 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 1782166952 Patch available CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in 2.88.0-1.1.hum1 Patch available CNA
- Red Hat Insights proxy 1.5 VendorRed Hat Affected — Fixed in 1780420428 Patch available CNA
- Red Hat OpenShift AI 3.4 VendorRed Hat Affected — Fixed in 1790703542 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798159 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798164 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798165 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798222 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787241211 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787135742 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787241260 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* | before 2.86.3 | Vulnerable | GNOME |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Red Hat |
- cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* Versions before 2.86.3 Vulnerable ·GNOME
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA glib (GNOME) Fixed in 2.86.3
Red Hat 30 advisories
- RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
- RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
- RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 27 more Red Hat advisories
- RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:74674 Released 2026-10-01 · Red Hat rating ImportantRed Hat AI Base Images 3.4.3 (Neuron)
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
- RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
- RHSA-2026:58981 Released 2026-08-24 · Red Hat rating CriticalRed Hat Update Infrastructure 5.3 Technology Preview security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
- RHSA-2026:49512 Released 2026-08-03 · Red Hat rating Importantmingw-glib2 security update
- Red Hat Enterprise Linux CRB (v. 8) mingw-glib2-2.70.1-9.el8_10, mingw32-glib2-2.70.1-9.el8_10, mingw32-glib2-static-2.70.1-9.el8_10 +2
- RHSA-2026:29197 Released 2026-06-24 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:25096 Released 2026-06-10 · Red Hat rating ImportantRed Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
- RHSA-2026:22634 Released 2026-06-02 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- RHSA-2026:21275 Released 2026-05-27 · Red Hat rating CriticalRed Hat Update Infrastructure 5.1 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
- RHSA-2026:19567 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) glib2-devel-2.80.4-4.el10_0.9, glib2-tests-2.80.4-4.el10_0.9
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) glib2-2.80.4-4.el10_0.9
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) glib2-doc-2.80.4-4.el10_0.9, glib2-static-2.80.4-4.el10_0.9
- RHSA-2026:19566 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) glib2-2.56.1-12.el7_9, glib2-2.56.1-12.el7_9.ppc, glib2-devel-2.56.1-12.el7_9 +1
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) glib2-doc-2.56.1-12.el7_9, glib2-fam-2.56.1-12.el7_9, glib2-static-2.56.1-12.el7_9 +2
- RHSA-2026:19565 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) glib2-2.56.4-10.el8_4.5, glib2-devel-2.56.4-10.el8_4.5, glib2-fam-2.56.4-10.el8_4.5 +1
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) glib2-2.56.4-10.el8_4.5, glib2-devel-2.56.4-10.el8_4.5, glib2-fam-2.56.4-10.el8_4.5 +1
- RHSA-2026:19524 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) glib2-2.56.4-158.el8_6.5, glib2-devel-2.56.4-158.el8_6.5, glib2-fam-2.56.4-158.el8_6.5 +1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) glib2-2.56.4-158.el8_6.5, glib2-devel-2.56.4-158.el8_6.5, glib2-fam-2.56.4-158.el8_6.5 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) glib2-2.56.4-158.el8_6.5, glib2-devel-2.56.4-158.el8_6.5, glib2-fam-2.56.4-158.el8_6.5 +1
- RHSA-2026:19523 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) glib2-2.56.4-165.el8_8, glib2-devel-2.56.4-165.el8_8, glib2-fam-2.56.4-165.el8_8 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) glib2-2.56.4-165.el8_8, glib2-devel-2.56.4-165.el8_8, glib2-fam-2.56.4-165.el8_8 +1
- RHSA-2026:19457 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) glib2-static-2.68.4-16.el9_6.5
- Red Hat Enterprise Linux AppStream EUS (v.9.6) glib2-devel-2.68.4-16.el9_6.5, glib2-doc-2.68.4-16.el9_6.5, glib2-tests-2.68.4-16.el9_6.5
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) glib2-2.68.4-16.el9_6.5
- RHSA-2026:19460 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) glib2-devel-2.68.4-7.el9_2.5, glib2-doc-2.68.4-7.el9_2.5, glib2-tests-2.68.4-7.el9_2.5
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) glib2-2.68.4-7.el9_2.5
- RHSA-2026:19452 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) glib2-static-2.68.4-14.el9_4.6
- Red Hat Enterprise Linux AppStream EUS (v.9.4) glib2-devel-2.68.4-14.el9_4.6, glib2-doc-2.68.4-14.el9_4.6, glib2-tests-2.68.4-14.el9_4.6
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) glib2-2.68.4-14.el9_4.6
- RHSA-2026:19459 Released 2026-05-20 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) glib2-devel-2.68.4-5.el9_0.5, glib2-doc-2.68.4-5.el9_0.5, glib2-tests-2.68.4-5.el9_0.5
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) glib2-2.68.4-5.el9_0.5
- RHSA-2026:19361 Released 2026-05-19 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream (v. 9) glib2-devel-2.68.4-19.el9_8.1, glib2-doc-2.68.4-19.el9_8.1, glib2-tests-2.68.4-19.el9_8.1
- Red Hat Enterprise Linux BaseOS (v. 9) glib2-2.68.4-19.el9_8.1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) glib2-static-2.68.4-19.el9_8.1
- RHSA-2026:19148 Released 2026-05-19 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream (v. 10) glib2-devel-2.80.4-12.el10_2.13, glib2-tests-2.80.4-12.el10_2.13
- Red Hat Enterprise Linux BaseOS (v. 10) glib2-2.80.4-12.el10_2.13
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glib2-doc-2.80.4-12.el10_2.13, glib2-static-2.80.4-12.el10_2.13
- RHSA-2026:15969 Released 2026-05-11 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream (v. 10) glib2-devel-2.80.4-10.el10_1.13, glib2-tests-2.80.4-10.el10_1.13
- Red Hat Enterprise Linux BaseOS (v. 10) glib2-2.80.4-10.el10_1.13
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glib2-doc-2.80.4-10.el10_1.13, glib2-static-2.80.4-10.el10_1.13
- RHSA-2026:15971 Released 2026-05-11 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux AppStream (v. 9) glib2-devel-2.68.4-18.el9_7.2, glib2-doc-2.68.4-18.el9_7.2, glib2-tests-2.68.4-18.el9_7.2
- Red Hat Enterprise Linux BaseOS (v. 9) glib2-2.68.4-18.el9_7.2
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) glib2-static-2.68.4-18.el9_7.2
- RHSA-2026:15953 Released 2026-05-11 · Red Hat rating Moderateglib2 security update
- Red Hat Enterprise Linux BaseOS (v. 8) glib2-2.56.4-169.el8_10, glib2-devel-2.56.4-169.el8_10, glib2-fam-2.56.4-169.el8_10 +1
- Red Hat Enterprise Linux CRB (v. 8) glib2-doc-2.56.4-169.el8_10, glib2-static-2.56.4-169.el8_10
- RHSA-2026:7461 Released 2026-04-10 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images glib2-2.88.0-1.1.hum1@aarch64, glib2-2.88.0-1.1.hum1@src, glib2-2.88.0-1.1.hum1@x86_64 +8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:15953
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:15969
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
Show 11 more groups
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:15971
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19148
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19361
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19452
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19457
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19459
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19460
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19523
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19524
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19565
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
- Advisory ·
GNOME Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 and 25 more products — RHSA-2026:19567
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-13255 Glib: integer overflow in glib gio attribute escaping causes heap buffer overflowPriority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | — |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888 |
| Cert Manager support for Red Hat OpenShift release 1.18 | Fixed | RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857 |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72502 |
| Red Hat AI Inference Server 3.2 | Fixed | RHSA-2026:25096 |
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Fixed | RHSA-2026:19452 |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:19457 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:29197 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:15969, RHSA-2026:19148 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:15971, RHSA-2026:19361 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:19459 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:19460 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:19567 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:19452 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:19457 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:15969, RHSA-2026:19148 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:15953 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:15971, RHSA-2026:19361 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2026:19565 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2026:19524 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2026:19524 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2026:19523 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2026:19459 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2026:19460 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2026:19567 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2026:19452 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.6) | Fixed | RHSA-2026:19457 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:19565 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2026:19524 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2026:19523 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:15953, RHSA-2026:49512 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:15969, RHSA-2026:19148 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:15971, RHSA-2026:19361 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:19567 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2026:19566 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2026:19566 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7461 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2026:22634 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:74674 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:21275, RHSA-2026:58981 |
Not affected: 4 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Update Infrastructure 5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14087
- 2026-10-03 Alias added: GHSA-frh9-7wfp-w73p
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-14 Fix available: cert-manager/cert-manager-istio-csr-rhel9@1791459759, cert-manager/cert-manager-operator-rhel9@1789029076, cert-manager/cert-manager-operator-rhel9@1791788287 +4 · CNA
- 2026-10-14 5 new references · CNA
- 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
- 2026-10-15 Fix available: cert-manager/cert-manager-operator-bundle@1791966259, cert-manager/cert-manager-operator-bundle@1791970484 · CNA
- 2026-10-15 2 new references · CNA
- 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
References
Advisory 32
- RHSA-2026:15953
- RHSA-2026:15969
- RHSA-2026:15971
- RHSA-2026:19148
- RHSA-2026:19361
- RHSA-2026:19452
- RHSA-2026:19457
- RHSA-2026:19459
- RHSA-2026:19460
- RHSA-2026:19523
- RHSA-2026:19524
- RHSA-2026:19565
- RHSA-2026:19566
- RHSA-2026:19567
- RHSA-2026:21275
- RHSA-2026:22634
- RHSA-2026:25096
- RHSA-2026:29197
- RHSA-2026:49512
- RHSA-2026:58981
- RHSA-2026:72502
- RHSA-2026:7461
- RHSA-2026:74674
- RHSA-2026:82304
- RHSA-2026:82322
- RHSA-2026:82347
- RHSA-2026:82354
- RHSA-2026:82372
- RHSA-2026:82857
- RHSA-2026:82888
- https://access.redhat.com/security/cve/CVE-2025-14087
- RHBZ#2419093
More GNOME Glib vulnerabilities
- TI-2026-41775 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVSS 3.1HIGH 8.6
- TI-2026-41772 Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime CVSS 3.1HIGH 7.5
- TI-2025-03596 Glib: glib crash after long command line CVSS 3.1HIGH 7.5
- TI-2023-15942 Gvariant deserialisation does not match spec for non-normal data CVSS 3.1MEDIUM 5.5
- TI-2024-35203 gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant… CVSS 3.1CRITICAL 9.8
- TI-2018-11777 In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-14087 · CVE Program
- CVE-2025-14087 · NVD
- FIRST EPSS
- GHSA-frh9-7wfp-w73p · GitHub Advisory Database · CC BY 4.0
- CVE-2025-14087 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences