CVE catalog

CVE-2025-6052

GLib vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.52% · Oct 25, 2026

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglib2.0sid2.90.1-2fixed
Debianglib2.0forky2.90.1-2fixed
Debianglib2.0trixie2.84.4-3~deb13u5fixed
Debianglib2.0bookworm2.74.6-2+deb12u9not affected
Debianglib2.0bookworm-security2.74.6-2+deb12u2not affected
Ubuntuglib2.0noble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-girepository-3.0noble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-girepository-3.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-glib-2.0noble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-glib-2.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntulibgirepository-2.0-0noble2.80.0-6ubuntu3.6fixed
Ubuntulibgirepository-2.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-0t64noble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-binnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-datanoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-dev-binnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-docnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-testsnoble2.80.0-6ubuntu3.6fixed
BitnamijreNot reported1.8.0fixed
BitnamijreNot reported8.0.481fixed
Bitnamijava-minNot reported1.8.0fixed
Bitnamijava-minNot reported8.0.481fixed
BitnamijavaNot reported1.8.0fixed
BitnamijavaNot reported8.0.481fixed
Ubuntuglib2.024.042.78.0-2vulnerable
Ubuntuglib2.024.042.78.1-4vulnerable
Ubuntuglib2.024.042.78.3-1vulnerable
Ubuntuglib2.024.042.78.3-2vulnerable
Ubuntuglib2.024.042.79.1-1vulnerable
Ubuntuglib2.024.042.79.2-1~ubuntu1vulnerable
Ubuntuglib2.024.042.79.3-3ubuntu5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.2vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.4vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.6fixed
Opensuseglib2tumbleweed2.84.3-1.1fixed
Suseglib2linux micro 6.12.78.6-slfo.1.1_4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglib2.0sourcesid2.84.3-1unimportantNot reported[1107797]
Debianglib2.0sourceforky2.84.3-1unimportantNot reported[1107797]
Debianglib2.0sourcetrixie2.84.3-1unimportantNot reported[1107797]
Debianglib2.0sourcebookwormNot affectedunimportantNot reported[1107797]
Ubuntuglib2.0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-0t64debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-bindebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-datadebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-dev-bindebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-docdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-testsdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
BitnamijreBitnamiNot reported1.8.0Not reportedBIT-JRE-2025-6052Not reported
BitnamijreBitnamiNot reported8.0.481Not reportedBIT-JRE-2025-6052Not reported
Bitnamijava-minBitnamiNot reported1.8.0Not reportedBIT-JAVA-MIN-2025-6052Not reported
Bitnamijava-minBitnamiNot reported8.0.481Not reportedBIT-JAVA-MIN-2025-6052Not reported
BitnamijavaBitnamiNot reported1.8.0Not reportedBIT-JAVA-2025-6052Not reported
BitnamijavaBitnamiNot reported8.0.481Not reportedBIT-JAVA-2025-6052Not reported
Ubuntuglib2.0deb24.042.80.0-6ubuntu3.6Not reportedUBUNTU-CVE-2025-6052Not reported
Opensuseglib2rpmtumbleweed2.84.3-1.1Not reportedOPENSUSE-SU-2025:15221-1Not reported
Suseglib2rpmlinux micro 6.12.78.6-slfo.1.1_4.1Not reportedSUSE-SU-2025:20673-1Not reported

[Debian bug #1107797]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [gio-branding-upstream]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-devel]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-devel-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-devel-static]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-lang]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-tests-devel]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-tools]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-tools-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgio-2_0-0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgio-2_0-0-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgirepository-2_0-0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libglib-2_0-0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libglib-2_0-0-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgmodule-2_0-0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgmodule-2_0-0-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgobject-2_0-0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgobject-2_0-0-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgthread-2_0-0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgthread-2_0-0-32bit]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [typelib-1_0-Gio-2_0]Unknown

    Source package: [glib2]

    Details (1)

    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.3-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]