Moderate Security Vulnerability in glib2 Package: Buffer Underflow and Integer Overflow Issues
Summary
ALSA-2026:15953: Moderate: glib2 security update. Affects glib2 versions < 2.56.4-169.el8_10. Fixed in 2.56.4-169.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GLib is a fundamental library that provides core application building blocks for C programming, widely used in GNOME applications. It includes an object system, main loop implementation, and various utility functions for strings and data structures. The glib2 package is essential for developers working with GNOME and other applications that rely on GLib for functionality.
Vulnerability Detail
The glib2 package has been identified with two significant vulnerabilities: a buffer underflow in the GVariant parser that can lead to heap corruption (CVE-2025-14087) and an integer overflow in GLib GIO attribute escaping that causes a heap buffer overflow (CVE-2025-14512). These vulnerabilities can potentially allow attackers to exploit the memory management of applications using GLib, leading to crashes or arbitrary code execution.
How To Fix
Minimum fixed version
2.56.4-169.el8_10
This is the first release that contains the fix.
sudo dnf update glib2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating is not immediately possible, consider limiting the use of applications that depend on the vulnerable versions of glib2 until the update can be applied. Additionally, review application configurations to minimize exposure to potential exploits.
Conclusion
The glib2 package has critical vulnerabilities that can lead to severe security risks. It is crucial for users and developers to update to the latest patched version to safeguard their applications. Regular monitoring of dependencies using tools like Vulert can help maintain security in open-source projects.
See every vulnerability recorded for glib2 →
FAQ
The vulnerabilities can lead to heap corruption and buffer overflows, which may allow attackers to execute arbitrary code or crash applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by the vulnerabilities without requiring any signup.
If an immediate update is not feasible, consider limiting the use of applications that rely on the vulnerable versions until you can apply the patch.
Versions prior to 2.56.4-169.el8_10 are affected by the vulnerabilities. Ensure to update to this version or later.
For detailed information, refer to the CVE pages: CVE-2025-14087 and CVE-2025-14512.
Related vulnerabilities
Recent vulnerabilities recorded for glib2.
