Out-of-bounds Read in Util-Linux
CVE-2025-14104
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (8.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H.
Affected products
- Util-linux — versions 0
- Red Hat Ceph Storage 7 — versions 1770632724, sha256:485411749726179fe5cd880e2cf308261b35150e4b356ddb7100f52e02b2e353
- Red Hat Ceph Storage 8 — versions sha256:2325f237ab329cb3f1d3db4da40ed19f68d6daa2a5902c71be3f0d3cfcadd503, 1770630907
- Red Hat Ceph Storage 9 — versions sha256:53a72419a7e4f4b332b9c6759ff1c389f226e26599236bc770d367c68bba911a, 1771816028
- Red Hat Enterprise Linux 10 — versions 0:2.40.2-15.el10_1
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8 — versions 0:2.32.1-48.el8_10
- Red Hat Enterprise Linux 9 — versions 0:2.37.4-21.el9_7
- Red Hat Hardened Images — versions 2.42-7.1.hum1
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2025-14104?
- CVE-2025-14104 is a medium-severity vulnerability in Util-Linux, classified under Out-of-bounds Read. CVSS score: 6.1/10. Published 2025-12-05.
- How severe is CVE-2025-14104?
- Medium severity. CVSS v3 base score is 6.1 out of 10.