CVE-2025-2722

What it actually does

The vulnerability allows a local attacker to trigger a heap-based buffer overflow by supplying a manipulated value for the n_alloced_params argument to the gsf_prop_settings_collect_va function in GNOME libgsf.

Why it matters to the business

Successful exploitation could allow local code execution or application crashes on affected systems, leading to privilege escalation or denial of service for users and processes relying on the library.

How an attack unfolds

An attacker with local access identifies an application using the vulnerable libgsf function, then supplies crafted input that manipulates n_alloced_params to overflow a heap buffer and achieve code execution.

How to fix it

Upgrade affected packages to the fixed versions provided by the vendor, such as chromium-browser 0:72.0.3626.81-1.el6_10.

How to confirm the fix worked

Confirm installed package versions meet or exceed the listed fixed releases and test that the vulnerable function is no longer reachable with malicious input.

Typical attack path

1. Obtain local access to a target system
2. Locate processes or applications that invoke gsf_prop_settings_collect_va
3. Craft input to manipulate the n_alloced_params argument
4. Trigger the heap buffer overflow to execute arbitrary code or crash the process

How to detect it

Review application crash logs and memory allocation events for signs of unexpected heap behavior in processes linked to libgsf; monitor for anomalous local process activity.

What your security team should do

• Apply vendor patches to all affected packages without delay
• Restrict local user access where feasible until updates are deployed
• Inventory applications that depend on libgsf and prioritize upgrades based on exposure