CVE-2025-2721

What it actually does

Heap-based buffer overflow in the gsf_base64_encode_simple function triggered by manipulation of a size_t argument, allowing memory corruption in affected GNOME libgsf versions up to 1.14.53.

Why it matters to the business

Local attackers can crash applications or potentially execute arbitrary code on systems using the vulnerable library, leading to downtime, data integrity issues, and possible compromise of container-related workloads in Red Hat environments where runc packages are impacted.

How an attack unfolds

An attacker with local access crafts malicious input that triggers the buffer overflow in gsf_base64_encode_simple when the library processes base64 data, resulting in heap corruption that can be leveraged for code execution.

How to fix it

Upgrade runc and runc-debuginfo packages on Red Hat rhel_extras_other:7 to version 0:1.0.0-59.dev.git2abd837.el7 or later; apply equivalent updates for any GNOME libgsf installations to versions beyond 1.14.53.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases using package managers, and test affected functions with sample base64 inputs to confirm absence of overflow behavior.

Typical attack path

1. Obtain local access to a system with vulnerable libgsf or dependent runc packages
2. Identify an application or process invoking gsf_base64_encode_simple
3. Supply crafted input that manipulates the size_t argument to overflow the heap buffer
4. Achieve memory corruption leading to arbitrary code execution or denial of service

How to detect it

Review system logs for unexpected crashes in processes using libgsf or runc, and inspect for anomalous memory usage patterns around base64 encoding operations; check package inventory for unpatched versions.

What your security team should do

• Prioritize patching runc packages on all Red Hat systems within the next maintenance window due to the critical classification
• Scan for any direct or indirect use of libgsf in container runtimes and applications
• Implement local access controls and application sandboxing to reduce attack surface
• Monitor for future vendor responses or patches if initial disclosure received no reply