CVE-2025-14104
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
Dec 5, 2025
CISA due date
—
The record
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | util-linux | 0 | 2.36.2-150300.4.50.1 |
| SUSE:Linux Enterprise Micro 5.2 | util-linux-systemd | 0 | 2.36.2-150300.4.50.1 |
| SUSE:Linux Enterprise Micro 5.5 | util-linux | 0 | 2.37.4-150500.9.20.1 |
| SUSE:Linux Enterprise Micro 5.5 | util-linux-systemd | 0 | 2.37.4-150500.9.20.1 |
| openSUSE:Leap 15.6 | python-libmount | 0 | 2.39.3-150600.4.15.1 |
| openSUSE:Leap 15.6 | python3-libmount | 0 | 2.37.4-150500.9.20.1 |
| openSUSE:Leap 15.6 | util-linux | 0 | 2.39.3-150600.4.15.1 |
| openSUSE:Leap 15.6 | util-linux | 0 | 2.37.4-150500.9.20.1 |
| openSUSE:Leap 15.6 | util-linux-systemd | 0 | 2.39.3-150600.4.15.1 |
| openSUSE:Leap 16.0 | python-libmount | 0 | 2.41.1-160000.3.1 |
| openSUSE:Leap 16.0 | util-linux | 0 | 2.41.1-160000.3.1 |
| openSUSE:Leap 16.0 | util-linux-systemd | 0 | 2.41.1-160000.3.1 |
| openSUSE:Tumbleweed | util-linux | 0 | 2.41.3-1.1 |
Related vulnerabilities
- CVE-2026-3184 A flaw was found in util-linux. Also affects util-linux
- CVE-2024-28085 wall in util-linux through 2.40, often installed with setgid tty permissions, allows… Also affects util-linux
- CVE-2026-27456 util-linux is a random collection of Linux utilities. Also affects python-libmount
- CVE-2016-5011 The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux… Also affects util-linux
- CVE-2026-92824 A flaw was found in libmodulemd. CWE-125
- CVE-2026-114038 A flaw was found in device-mapper-multipath. CWE-125
- CVE-2026-112896 Pillow is a Python imaging library. CWE-125
- CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in… CWE-125