CVE-2025-4056

Glib: glib crash after long command line

7.5 HighFix available

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.54%Up 0.5 points since Jul 29, 2025

What each source reports

CVE List Score used 7.5

Glib: glib crash after long command line

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Record: CVE-2025-4056
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-94
Updated: 2026-11-06

EUVDEUVD-2025-22903 7.5

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Record: EUVD-2025-22903
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

GitHub AdvisoriesGHSA-6gjq-8hm4-wjmq 3.7

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application...

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Record: GHSA-6gjq-8hm4-wjmq
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-94
Updated: 2026-11-02

NVD 7.5

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Record: CVE-2025-4056
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-94
Updated: 2026-11-06

OSVBELL-CVE-2025-4056 7.5

CVE-2025-4056 does not affect BellSoft software

Record: BELL-CVE-2025-4056
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Glib: glib crash after long command line

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Record: CVE-2025-4056
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-94
Updated: 2026-11-07

OSVJLSEC-2025-168 7.5

A flaw was found in GLib

A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

Record: JLSEC-2025-168
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-1551 3.7

glib2 security update

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A vulnerability was found in GNU GLib up to 2.84.0 on Windows (Software Library). It has been rated as problematic. Affected by this issue is some unknown processing of the component Command Line Handler. Upgrading to version 2.84.1 eliminates this vulnerability.(CVE-2025-4056)

Record: OESA-2025-1551
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-4056 No score

Integer Overflow in protect_argv_string Method

Record: UBUNTU-CVE-2025-4056
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`Glib_jll` Julia	before 2.84.3+0	2.84.3+0
`glib2` openEuler:22.03-LTS-SP4	before 2.72.2-21.oe2203sp4	2.72.2-21.oe2203sp4
`glib2` openEuler:24.03-LTS	before 2.78.3-8.oe2403sp1	2.78.3-8.oe2403sp1
`glib2` openEuler:24.03-LTS-SP1	before 2.78.3-8.oe2403sp1	2.78.3-8.oe2403sp1
`glib2` openEuler:20.03-LTS-SP4	before 2.66.8-19.oe2003sp4	2.66.8-19.oe2003sp4
`glib2` openEuler:22.03-LTS-SP3	before 2.72.2-21.oe2203sp3	2.72.2-21.oe2203sp3

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts	CVE List
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-4056 is a high vulnerability (CVSS 7.5) in Gnome Glib, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in Glib_jll 2.84.3+0.

References

Show 6 moreShow less