What is CVE-2025-0577?

CVE-2025-0577 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, classified under Insufficient Entropy. CVSS score: 4.8/10. Published 2026-02-18.

How severe is CVE-2025-0577?

Medium severity. CVSS v3 base score is 4.8 out of 10.

Vulnerability in Red Hat Enterprise Linux 10

CVE-2025-0577

An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions.

EPSS: 0.002 (15.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Weakness classification (CWE)

CWE-331 — Insufficient Entropy

References

patrick@puiterwijk.org (x_refsource_REDHAT, vdb-entry)
patrick@puiterwijk.org (x_refsource_REDHAT, issue-tracking)

Frequently asked questions

What is CVE-2025-0577?: CVE-2025-0577 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, classified under Insufficient Entropy. CVSS score: 4.8/10. Published 2026-02-18.
How severe is CVE-2025-0577?: Medium severity. CVSS v3 base score is 4.8 out of 10.