CVE-2023-32643

A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer...

5.3 MediumFix available

A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.38%Up 0.3 points since Sep 15, 2023

What each source reports

CVE List Score used 5.3

Record: CVE-2023-32643
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2023-36886 5.3

Record: EUVD-2023-36886
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8jhw-fpw9-r227 5.3

A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer...

Record: GHSA-8jhw-fpw9-r227
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-122, CWE-787
Updated: 2026-11-02

NVD 5.3

Record: CVE-2023-32643
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122, CWE-787
Updated: 2026-11-02

OSVAZL-28777 7.8

CVE-2023-32643 affecting package glib for versions less than 2.71.0-4

Record: AZL-28777
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-32643 7.8

CVE-2023-32643 does not affect BellSoft software

Record: BELL-CVE-2023-32643
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSV 5.3

Record: CVE-2023-32643
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-122
Updated: 2026-11-02

OSVJLSEC-2025-163 7.8

A flaw was found in GLib

Record: JLSEC-2025-163
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-32643 7.8

Record: UBUNTU-CVE-2023-32643
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVCLSA-2023-1697135256 No score

glib2: Fix of 5 CVEs

CVE-2023-29499: Fix GVariant offset table entry size which is not checked in is_normal()
CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time with some non-normal inputs
CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data
CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
Fix g_test_bug assertion in gvariant test

Record: CLSA-2023-1697135256
Updated: 2026-11-02

OSVCLSA-2023-1697740212 No score

glib2: Fix of 5 CVEs

Enable internal tests
Skip several failed tests from the check
CVE-2023-29499: Fix GVariant offset table entry size which is not checked in is_normal()
CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time with some non-normal inputs
CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data
CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
Fix g_test_bug assertion in gvariant test

Record: CLSA-2023-1697740212
Updated: 2026-11-02

OSVCLSA-2023-1697740947 No score

glib2: Fix of 5 CVEs

Enable internal tests
Skip several failed tests from the check
CVE-2023-29499: Fix GVariant offset table entry size which is not checked in is_normal()
CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time with some non-normal inputs
CVE-2023-32665: Fix GVariant deserialisation which does not match spec for non-normal data
CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()
CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()
Fix g_test_bug assertion in gvariant test

Record: CLSA-2023-1697740947
Updated: 2026-11-02

OSVCLSA-2023-1697741722 No score

Fix of 5 CVEs

SECURITY UPDATE: GVariant security issues
- debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple GVariant serialization issues
- CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665
debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion in gvariant test
debian/patches/libglib2.0-0.symbols: Add new symbols

Record: CLSA-2023-1697741722
Updated: 2026-11-02

OSVCLSA-2023-1697741849 No score

Fix of 5 CVEs

SECURITY UPDATE: GVariant security issues
- debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple GVariant serialization issues
- CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665
debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion in gvariant test
debian/patches/skip-several-failed-tests.patch: Skip several failed tests
debian/patches/libglib2.0-0.symbols: Add new symbol

Record: CLSA-2023-1697741849
Updated: 2026-11-02

OSVSUSE-SU-2023:3535-1 No score

Security update for glib2

This update for glib2 fixes the following issues:

CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files. (bsc#1183533)
CVE-2023-32665: Fixed GVariant deserialisation which does not match spec for non-normal data. (bsc#1211945)
CVE-2023-32643: Fixed a heap-buffer-overflow in g_variant_serialised_get_child(). (bsc#1211946)
CVE-2023-29499: Fixed GVariant offset table entry size which is not checked in is_normal(). (bsc#1211947)
CVE-2023-32636: Fixed a wrong timeout in fuzz_variant_text(). (bsc#1211948)
CVE-2023-32611: Fixed an issue where g_variant_byteswap() can take a long time with some non-normal inputs. (bsc#1211951)

Record: SUSE-SU-2023:3535-1
Updated: 2026-11-02

OSVUSN-6165-1 No score

glib2.0 vulnerabilities

It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks.

Record: USN-6165-1
Updated: 2026-11-02

OSVUSN-6165-2 No score

glib2.0 vulnerabilities

USN-6165-1 fixed vulnerabilities in GLib. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks.

Record: USN-6165-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`glib` Azure Linux:2	before 2.71.0-4	2.71.0-4
`glib2` TuxCare:CentOS:7 From an advisory covering 5 CVEs	before 2.56.1-9.el7_9.tuxcare.els2	2.56.1-9.el7_9.tuxcare.els2
`glib2-devel` TuxCare:CentOS:7 From an advisory covering 5 CVEs	before 2.56.1-9.el7_9.tuxcare.els2	2.56.1-9.el7_9.tuxcare.els2
`glib2-doc` TuxCare:CentOS:7 From an advisory covering 5 CVEs	before 2.56.1-9.el7_9.tuxcare.els2	2.56.1-9.el7_9.tuxcare.els2
`glib2-fam` TuxCare:CentOS:7 From an advisory covering 5 CVEs	before 2.56.1-9.el7_9.tuxcare.els2	2.56.1-9.el7_9.tuxcare.els2
`glib2-static` TuxCare:CentOS:7 From an advisory covering 5 CVEs	before 2.56.1-9.el7_9.tuxcare.els2	2.56.1-9.el7_9.tuxcare.els2
`glib2-tests` TuxCare:CentOS:7 From an advisory covering 5 CVEs	before 2.56.1-9.el7_9.tuxcare.els2	2.56.1-9.el7_9.tuxcare.els2
`glib2` TuxCare:CentOS:8.4 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-devel` TuxCare:CentOS:8.4 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-doc` TuxCare:CentOS:8.4 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1

Show 38 moreShow less

Affected packages
Package	Affected	Fixed
`glib2-fam` TuxCare:CentOS:8.4 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-static` TuxCare:CentOS:8.4 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-tests` TuxCare:CentOS:8.4 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2` TuxCare:CentOS:8.5 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-devel` TuxCare:CentOS:8.5 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-doc` TuxCare:CentOS:8.5 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-fam` TuxCare:CentOS:8.5 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-static` TuxCare:CentOS:8.5 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`glib2-tests` TuxCare:CentOS:8.5 From an advisory covering 5 CVEs	before 2.56.4-156.el8.tuxcare.els1	2.56.4-156.el8.tuxcare.els1
`libglib2.0-0` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-0-refdbg` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-bin` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-data` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-dev` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-doc` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-tests` TuxCare:Ubuntu:16.04 From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+tuxcare.els2	2.48.2-0ubuntu4.8+tuxcare.els2
`libglib2.0-0` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`libglib2.0-bin` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`libglib2.0-data` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`libglib2.0-dev` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`libglib2.0-dev-bin` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`libglib2.0-doc` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`libglib2.0-tests` TuxCare:Ubuntu:18.04 From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+tuxcare.els1	2.56.4-0ubuntu0.18.04.9+tuxcare.els1
`Glib_jll` Julia	before 2.76.5+0	2.76.5+0
`glib2` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 6 CVEs	before 2.54.3-150000.4.29.1	2.54.3-150000.4.29.1
`glib2` SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 6 CVEs	before 2.54.3-150000.4.29.1	2.54.3-150000.4.29.1
`glib2` SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 6 CVEs	before 2.54.3-150000.4.29.1	2.54.3-150000.4.29.1
`glib2` SUSE:Enterprise Storage 6 From an advisory covering 6 CVEs	before 2.54.3-150000.4.29.1	2.54.3-150000.4.29.1
`glib2.0` Ubuntu:Pro:14.04:LTS	before 2.40.2-0ubuntu1.1+esm6, plus listed versions 2.38.0-1ubuntu12.38.1-12.39.1-0ubuntu12.39.1-0ubuntu22.39.1-0ubuntu3 Show 17 moreShow less 2.39.2-0ubuntu12.39.2-0ubuntu22.39.3-0ubuntu42.39.4-0ubuntu12.39.90-0ubuntu12.39.91-0ubuntu22.39.91-0ubuntu32.39.92-22.40.0-12.40.0-1ubuntu12.40.0-22.40.2-0ubuntu12.40.2-0ubuntu1.12.40.2-0ubuntu1.1+esm12.40.2-0ubuntu1.1+esm22.40.2-0ubuntu1.1+esm32.40.2-0ubuntu1.1+esm4	2.40.2-0ubuntu1.1+esm6
`glib2.0` Ubuntu:Pro:16.04:LTS	before 2.48.2-0ubuntu4.8+esm3, plus listed versions 2.46.1-12.46.1-22.47.1-12.47.3-32.47.4-1 Show 17 moreShow less 2.47.5-12.47.6-12.48.0-1ubuntu32.48.0-1ubuntu42.48.1-1~ubuntu16.04.12.48.2-0ubuntu12.48.2-0ubuntu32.48.2-0ubuntu42.48.2-0ubuntu4.12.48.2-0ubuntu4.22.48.2-0ubuntu4.32.48.2-0ubuntu4.42.48.2-0ubuntu4.52.48.2-0ubuntu4.62.48.2-0ubuntu4.72.48.2-0ubuntu4.82.48.2-0ubuntu4.8+esm1	2.48.2-0ubuntu4.8+esm3
`glib2.0` Ubuntu:Pro:18.04:LTS	before 2.56.4-0ubuntu0.18.04.9+esm3, plus listed versions 2.54.1-1ubuntu12.55.2-2ubuntu12.56.0-2ubuntu12.56.0-4ubuntu12.56.1-2ubuntu1 Show 11 moreShow less 2.56.2-0ubuntu0.18.04.12.56.2-0ubuntu0.18.04.22.56.3-0ubuntu0.18.04.12.56.4-0ubuntu0.18.04.22.56.4-0ubuntu0.18.04.32.56.4-0ubuntu0.18.04.42.56.4-0ubuntu0.18.04.52.56.4-0ubuntu0.18.04.62.56.4-0ubuntu0.18.04.72.56.4-0ubuntu0.18.04.82.56.4-0ubuntu0.18.04.9	2.56.4-0ubuntu0.18.04.9+esm3
`glib2.0` Ubuntu:20.04:LTS	before 2.64.6-1~ubuntu20.04.6, plus listed versions 2.62.1-12.63.1-22.63.1-2ubuntu12.63.3-12.63.3-3 Show 9 moreShow less 2.63.5-22.64.0-12.64.1-12.64.2-1~fakesync12.64.3-1~ubuntu20.04.12.64.6-1~ubuntu20.04.12.64.6-1~ubuntu20.04.22.64.6-1~ubuntu20.04.32.64.6-1~ubuntu20.04.4	2.64.6-1~ubuntu20.04.6
`glib2.0` Ubuntu:22.04:LTS	before 2.72.4-0ubuntu2.2, plus listed versions 2.68.4-1ubuntu12.70.1-12.70.2-12.71.0-22.71.1-1 Show 6 moreShow less 2.71.2-12.71.3-12.72.0-12.72.1-12.72.4-0ubuntu12.72.4-0ubuntu2	2.72.4-0ubuntu2.2
`glib2.0` Ubuntu:20.04:LTS From an advisory covering 7 CVEs	before 2.64.6-1~ubuntu20.04.6, plus listed versions 2.62.1-12.63.1-22.63.1-2ubuntu12.63.3-12.63.3-3 Show 9 moreShow less 2.63.5-22.64.0-12.64.1-12.64.2-1~fakesync12.64.3-1~ubuntu20.04.12.64.6-1~ubuntu20.04.12.64.6-1~ubuntu20.04.22.64.6-1~ubuntu20.04.32.64.6-1~ubuntu20.04.4	2.64.6-1~ubuntu20.04.6
`glib2.0` Ubuntu:22.04:LTS From an advisory covering 7 CVEs	before 2.72.4-0ubuntu2.2, plus listed versions 2.68.4-1ubuntu12.70.1-12.70.2-12.71.0-22.71.1-1 Show 6 moreShow less 2.71.2-12.71.3-12.72.0-12.72.1-12.72.4-0ubuntu12.72.4-0ubuntu2	2.72.4-0ubuntu2.2
`glib2.0` Ubuntu:Pro:14.04:LTS From an advisory covering 5 CVEs	before 2.40.2-0ubuntu1.1+esm6, plus listed versions 2.38.0-1ubuntu12.38.1-12.39.1-0ubuntu12.39.1-0ubuntu22.39.1-0ubuntu3 Show 17 moreShow less 2.39.2-0ubuntu12.39.2-0ubuntu22.39.3-0ubuntu42.39.4-0ubuntu12.39.90-0ubuntu12.39.91-0ubuntu22.39.91-0ubuntu32.39.92-22.40.0-12.40.0-1ubuntu12.40.0-22.40.2-0ubuntu12.40.2-0ubuntu1.12.40.2-0ubuntu1.1+esm12.40.2-0ubuntu1.1+esm22.40.2-0ubuntu1.1+esm32.40.2-0ubuntu1.1+esm4	2.40.2-0ubuntu1.1+esm6
`glib2.0` Ubuntu:Pro:16.04:LTS From an advisory covering 5 CVEs	before 2.48.2-0ubuntu4.8+esm3, plus listed versions 2.46.1-12.46.1-22.47.1-12.47.3-32.47.4-1 Show 17 moreShow less 2.47.5-12.47.6-12.48.0-1ubuntu32.48.0-1ubuntu42.48.1-1~ubuntu16.04.12.48.2-0ubuntu12.48.2-0ubuntu32.48.2-0ubuntu42.48.2-0ubuntu4.12.48.2-0ubuntu4.22.48.2-0ubuntu4.32.48.2-0ubuntu4.42.48.2-0ubuntu4.52.48.2-0ubuntu4.62.48.2-0ubuntu4.72.48.2-0ubuntu4.82.48.2-0ubuntu4.8+esm1	2.48.2-0ubuntu4.8+esm3
`glib2.0` Ubuntu:Pro:18.04:LTS From an advisory covering 5 CVEs	before 2.56.4-0ubuntu0.18.04.9+esm3, plus listed versions 2.54.1-1ubuntu12.55.2-2ubuntu12.56.0-2ubuntu12.56.0-4ubuntu12.56.1-2ubuntu1 Show 11 moreShow less 2.56.2-0ubuntu0.18.04.12.56.2-0ubuntu0.18.04.22.56.3-0ubuntu0.18.04.12.56.4-0ubuntu0.18.04.22.56.4-0ubuntu0.18.04.32.56.4-0ubuntu0.18.04.42.56.4-0ubuntu0.18.04.52.56.4-0ubuntu0.18.04.62.56.4-0ubuntu0.18.04.72.56.4-0ubuntu0.18.04.82.56.4-0ubuntu0.18.04.9	2.56.4-0ubuntu0.18.04.9+esm3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32643 is a medium vulnerability (CVSS 5.3) in Glib, published June 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in glib 2.71.0-4.

References

Show 31 moreShow less