CVE-2025-13601

Published Nov 26, 2025

Last updated 5 days ago

Overview

Description
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Source
secalert@redhat.com
NVD status
Modified
Products
codeready_linux_builder, codeready_linux_builder_for_ibm_z_systems, codeready_linux_builder_for_power_little_endian, codeready_linux_builder_for_x86_64, enterprise_linux_for_arm_64, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_power_little_endian, enterprise_linux_for_x86_64, codeready_linux_builder_for_arm64, enterprise_linux_server_aus, codeready_linux_builder_for_arm64_eus, enterprise_linux_for_x86_64_eus, enterprise_linux_server_for_power_little_endian, enterprise_linux_server_for_power_little_endian_eus, codeready_linux_builder_for_ibm_z_systems_eus, codeready_linux_builder_for_power_little_endian_eus, codeready_linux_builder_for_x86_64_eus, enterprise_linux_for_arm_64_eus, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_power_little_endian_eus, enterprise_linux_server_tus, ceph_storage, discovery, glib, openshift_container_platform, openshift_container_platform_for_arm64, openshift_container_platform_for_ibm_z, openshift_container_platform_for_linuxone, openshift_container_platform_for_power

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.7
Impact score
5.2
Exploitability score
2.5
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity
HIGH

Weaknesses

secalert@redhat.com
CWE-190

Social media

Hype score
Not currently trending
  1. ๐Ÿšจ #OracleLinux 8 Admins: New security update ELSA-2026-0991 patches glib2 for CVE-2025-13601 (Moderate buffer overflow). Read more: ๐Ÿ‘‰ https://t.co/ox3xkOsNfK #Security https://t.co/Pq4oOTDwUC

    @Cezar_H_Linux

    24 Jan 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. URGENT: Critical glib2 vulnerabilities patched in #SUSE Linux (CVE-2025-13601, -14087, -14512). CVSS to 7.7 . Read more: ๐Ÿ‘‰ https://t.co/VJGJSeHRfY #Security https://t.co/a3JetbDFyj

    @Cezar_H_Linux

    18 Dec 2025

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Security Bulletin: CVE-2025-13601 / glib2 on Fedora 43. The #Fedora project has released glib2 2.86.2 to remediate a critical integer overflow vulnerability (CVE-2025-13601) in the g_escape_uri_string() function. Read more: ๐Ÿ‘‰ https://t.co/SUnwdTAXEL #Security ht

    @Cezar_H_Linux

    1 Dec 2025

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2025-13601 (CVSS:7.7, HIGH) is Received. A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_u..https://t.co/dLZbQen94m #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    1 Dec 2025

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2025-13601 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape โ€ฆ https://t.co/UkaGJ1OJiG

    @CVEnew

    26 Nov 2025

    230 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations