CVE-2025-13601: Gnome Glib

High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days.

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

Affected products

  • Gnome Glib: before 2.86.3 (fixed in 2.86.3)
  • Red Hat Ceph Storage: version 8.0 only
  • Red Hat Codeready Linux Builder: version 9.0 only
  • Red Hat Codeready Linux Builder For ARM64: version 10.0 only; version 8.0 only; version 9.6 only
  • Red Hat Codeready Linux Builder For ARM64 Eus: version 9.4 only; version 10.0 only
  • Red Hat Codeready Linux Builder For IBM Z Systems: version 9.0_s390x only; version 10.0_s390x only; version 8.0_s390x only; version 9.4_s390x only; version 9.6_s390x only
  • Red Hat Codeready Linux Builder For IBM Z Systems Eus: version 10.0_s390x only
  • Red Hat Codeready Linux Builder For Power Little Endian: version 9.0_ppc64le only; version 10.0_ppc64le only; version 8.0_ppc64le only; version 9.4_ppc64le only; version 9.6_ppc64le only
  • Red Hat Codeready Linux Builder For Power Little Endian Eus: version 10.0_ppc64le only
  • Red Hat Codeready Linux Builder For x86 64: version 9.0 only; version 10.0 only; version 8.0 only; version 9.4 only; version 9.6 only
  • Red Hat Codeready Linux Builder For x86 64 Eus: version 10.0 only
  • Red Hat Discovery: version 2.0 only
  • Red Hat Enterprise Linux For Arm 64: version 9.0 only; version 10.0 only; version 8.0 only; version 9.2 only; version 9.4 only; version 9.6 only
  • Red Hat Enterprise Linux For Arm 64 Eus: version 10.0 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 9.0_s390x only; version 10.0_s390x only; version 8.0_s390x only; version 9.2_s390x only; version 9.4_s390x only; version 9.6_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 10.0_s390x only
  • Red Hat Enterprise Linux For Power Little Endian: version 9.0_ppc64le only; version 10.0_ppc64le only; version 8.0_ppc64le only; version 9.2_ppc64le only; version 9.4_ppc64le only; version 9.6_ppc64le only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 10.0_ppc64le only; version 9.6_ppc64le only
  • Red Hat Enterprise Linux For x86 64: version 9.0 only; version 10.0 only; version 8.0 only; version 9.2 only; version 9.4 only; version 9.6 only; …
  • Red Hat Enterprise Linux For x86 64 Eus: version 9.4 only; version 10.0 only; version 9.6 only; version 8.6 only; version 8.8 only; version 8.4 only
  • Red Hat Enterprise Linux Server Aus: version 9.2 only; version 9.4 only; version 9.6 only; version 8.6 only; version 8.4 only; version 8.2 only
  • Red Hat Enterprise Linux Server For Power Little Endian: version 9.4_ppc64le only; version 10.0_ppc64le only; version 9.6_ppc64le only; version 8.6_ppc64le only; version 8.8_ppc64le only
  • Red Hat Enterprise Linux Server For Power Little Endian Eus: version 9.4_ppc64le only
  • Red Hat Enterprise Linux Server Tus: version 8.6 only; version 8.8 only
  • Red Hat Openshift Container Platform: version 4.12 only; version 4.16 only; version 4.17 only; version 4.18 only; version 4.19 only
  • and 4 more

Published 2025-11-26. Last modified 2026-08-31.