Moderate Security Update for GLib2: Buffer Underflow and Integer Overflow Vulnerabilities
Summary
ALSA-2026:19148: Moderate: glib2 security update. Affects glib2 versions < 2.80.4-12.el10_2.13. Fixed in 2.80.4-12.el10_2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GLib is a fundamental library that provides essential building blocks for applications and libraries written in C. It serves as the core object system for GNOME, implements the main event loop, and offers a wide array of utility functions for handling strings and common data structures. Given its extensive use in various applications, vulnerabilities in GLib can have far-reaching consequences.
Vulnerability Detail
The vulnerabilities identified in GLib include a buffer underflow in the GVariant parser, which can lead to heap corruption (CVE-2025-14087), and an integer overflow in GLib's GIO attribute escaping, causing a heap buffer overflow (CVE-2025-14512). These vulnerabilities can be exploited by attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of affected systems.
How To Fix
Minimum fixed version
2.80.4-12.el10_2.13
This is the first release that contains the fix.
sudo dnf update glib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of affected functionalities in GLib until the update is applied. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The identified vulnerabilities in GLib pose significant risks to applications relying on this library. It is crucial to update to the patched version to mitigate these risks and ensure the security of your systems.
See every vulnerability recorded for glib2 →
FAQ
GLib is a low-level core library that forms the foundation for libraries and applications written in C, providing essential data structures and utility functions.
The vulnerabilities include a buffer underflow in the GVariant parser and an integer overflow in GIO attribute escaping, both of which can lead to serious security issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider limiting the use of the affected functionalities until the update can be applied.
For detailed information, refer to the CVE pages associated with CVE-2025-14087 and CVE-2025-14512.
Related vulnerabilities
Recent vulnerabilities recorded for glib2.
