CVE-2025-13601
High · 7.7CVSS
7.7
EPSS
0.3%
Published
Nov 26, 2025
CISA due date
—
The record
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | glib2 | 0 | 2.80.4-10.el10_1.12 |
| AlmaLinux:10 | glib2-devel | 0 | 2.80.4-10.el10_1.12 |
| AlmaLinux:10 | glib2-doc | 0 | 2.80.4-10.el10_1.12 |
| AlmaLinux:10 | glib2-static | 0 | 2.80.4-10.el10_1.12 |
| AlmaLinux:10 | glib2-tests | 0 | 2.80.4-10.el10_1.12 |
| AlmaLinux:8 | glib2 | 0 | 2.56.4-168.el8_10 |
| AlmaLinux:8 | glib2-devel | 0 | 2.56.4-168.el8_10 |
| AlmaLinux:8 | glib2-doc | 0 | 2.56.4-168.el8_10 |
| AlmaLinux:8 | glib2-fam | 0 | 2.56.4-168.el8_10 |
| AlmaLinux:8 | glib2-static | 0 | 2.56.4-168.el8_10 |
| AlmaLinux:8 | glib2-tests | 0 | 2.56.4-168.el8_10 |
| AlmaLinux:9 | glib2 | 0 | 2.68.4-18.el9_7.1 |
| AlmaLinux:9 | glib2-devel | 0 | 2.68.4-18.el9_7.1 |
| AlmaLinux:9 | glib2-doc | 0 | 2.68.4-18.el9_7.1 |
| AlmaLinux:9 | glib2-static | 0 | 2.68.4-18.el9_7.1 |
| AlmaLinux:9 | glib2-tests | 0 | 2.68.4-18.el9_7.1 |
| Mageia:9 | glib2.0 | 0 | 2.76.3-1.6.mga9 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Micro 5.3 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Micro 5.4 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Micro 5.5 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | glib2 | 0 | 2.78.6-150600.4.25.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | glib2 | 0 | 2.78.6-150600.4.25.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | glib2 | 0 | 2.78.6-150600.4.25.1 |
| SUSE:Manager Proxy LTS 4.3 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| SUSE:Manager Server LTS 4.3 | glib2 | 0 | 2.70.5-150400.3.29.1 |
| openSUSE:Leap 15.6 | glib2 | 0 | 2.78.6-150600.4.25.1 |
| openSUSE:Leap 15.6 | glib2-doc | 0 | 2.78.6-150600.4.25.1 |
| openSUSE:Leap 16.0 | glib2 | 0 | 2.84.4-160000.1.1 |
| openSUSE:Leap 16.0 | glib2-doc | 0 | 2.84.4-160000.1.1 |
| openSUSE:Tumbleweed | glib2 | 0 | 2.86.3-1.1 |
Related vulnerabilities
- CVE-2024-52533 gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant… Also affects glib2
- CVE-2024-34397 An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Also affects glib2
- CVE-2023-32611 A flaw was found in GLib. Also affects glib2
- CVE-2026-0988 A flaw was found in glib. Also affects glib2.0
- CVE-2025-14512 A flaw was found in glib. Also affects glib2.0
- CVE-2025-14087 A flaw was found in GLib (Gnome Lib). Also affects glib2.0
- CVE-2026-1489 A flaw was found in GLib. Also affects glib2
- CVE-2026-1484 A flaw was found in the GLib Base64 encoding routine when processing very large input… Also affects glib2