Integer overflow in GNOME Glib
CVE-2025-13601
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Vulnerability class: Integer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (23.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 23.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- GNOME Glib
- Red Hat Ceph Storage 8 — versions sha256:09aaeba975aa74bdf95d63e5619c0cabb1cd9e1410aa34e7f8ecf24a5e291d1a, 1769512383
- Red Hat Discovery 2 — versions 1769104765, 1769111774, sha256:26bb49a8e2e695d61192f04eb0db63efa8210bba20ea22b60e4e22d519d8b9e6
- Red Hat Enterprise Linux 10 — versions 0:2.80.4-10.el10_1.12, 0:2.87.0-1.el10
- Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:2.80.4-4.el10_0.8
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7 Extended Lifecycle Support — versions 0:2.56.1-11.el7_9
- Red Hat Enterprise Linux 8 — versions 0:2.56.4-168.el8_10
- Red Hat Enterprise Linux 8.2 Advanced Update Support — versions 0:2.56.4-8.el8_2.4
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 0:2.56.4-10.el8_4.4
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2026:0936 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:0975 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:0991 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1323 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1324 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1326 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1327 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1465 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1608 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:1624 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-13601?
- CVE-2025-13601 is a high-severity vulnerability in GNOME Glib, classified under Integer Overflow or Wraparound. CVSS score: 7.7/10. Published 2025-11-26.
- How severe is CVE-2025-13601?
- High severity. CVSS v3 base score is 7.7 out of 10.