Every CVE Search/ Get API key

CVE-2025-6052

Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

3.7 LowFix available

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.52%Up 0.5 points since Jun 14, 2025
90%50%10%1%

What each source reports

CVE List Score used 3.7

Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
CVE-2025-6052
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2025-18285 3.7

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
EUVD-2025-18285
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-99rj-3595-5frj 3.7

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is...

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
GHSA-99rj-3595-5frj
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 3.7

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
CVE-2025-6052
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVBELL-CVE-2025-6052 7.5
Record
BELL-CVE-2025-6052
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 3.7

Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
CVE-2025-6052
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2025-6052 7.5

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
DEBIAN-CVE-2025-6052
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2025-167 7.5

A flaw was found in how GLib’s GString manages memory when adding data to strings

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
JLSEC-2025-167
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1795 3.7

glib2 security update

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.(CVE-2025-6052)

Record
OESA-2025-1795
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1796 3.7

glib2 security update

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.(CVE-2025-6052)

Record
OESA-2025-1796
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1797 3.7

glib2 security update

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.(CVE-2025-6052)

Record
OESA-2025-1797
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-6052 3.7

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
UBUNTU-CVE-2025-6052
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-63912 No score

CVE-2025-6052 affecting package glib for versions less than 2.78.6-3

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
AZL-63912
Updated
2026-11-05
OSVBIT-java-2025-6052 No score

Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
BIT-java-2025-6052
Updated
2026-11-02
OSVBIT-java-min-2025-6052 No score

Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
BIT-java-min-2025-6052
Updated
2026-11-02
OSVBIT-jre-2025-6052 No score

Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
BIT-jre-2025-6052
Updated
2026-11-02
OSVMGASA-2025-0216 No score

Updated glib2.0 packages fix security vulnerability

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Record
MGASA-2025-0216
Updated
2026-11-02
OSVopenSUSE-SU-2025:15221-1 No score

gio-branding-upstream-2.84.3-1.1 on GA media

These are all security issues fixed in the gio-branding-upstream-2.84.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15221-1
Updated
2026-11-02
OSVSUSE-SU-2025:02167-1 No score

Security update for glib2

This update for glib2 fixes the following issues:

  • CVE-2025-6052: Fixed integer overflow in g_string_maybe_expand() leads to potential buffer overflow in GString (bsc#1244596).
  • CVE-2025-4373: Fixed buffer underflow through glib/gstring.c via function g_string_insert_unichar (bsc#1242844).
Record
SUSE-SU-2025:02167-1
Updated
2026-11-02
OSVSUSE-SU-2025:20508-1 No score

Security update for glib2

This update for glib2 fixes the following issues:

  • CVE-2025-4373: Fixed buffer underflow through glib/gstring.c via function g_string_insert_unichar (bsc#1242844)
  • CVE-2025-6052: Fixed integer overflow in g_string_maybe_expand() leads to potential buffer overflow in GString (bsc#1244596)
Record
SUSE-SU-2025:20508-1
Updated
2026-11-02
OSVSUSE-SU-2025:20673-1 No score

Security update for glib2

This update for glib2 fixes the following issues:

  • CVE-2025-6052: Fix overflow check when expanding a GString (bsc#1244596).
Record
SUSE-SU-2025:20673-1
Updated
2026-11-02
OSVUSN-7942-1 No score

glib2.0 vulnerabilities

It was discovered that GLib incorrectly handled escaping URI strings. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-13601)

It was discovered that GLib incorrectly parsed certain GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-14087)

It was discovered that GLib incorrectly parsed certain long invalid ISO 8601 timestamps. An attacker could possibly use this issue to cause GLib to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-3360)

It was discovered that GLib incorrectly handled GString memory operations. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2025-6052)

It was discovered that GLib incorrectly handled creating temporary files. An attacker could possibly use this issue to access unauthorized data. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2025-7039)

Record
USN-7942-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glib
Azure Linux:3
 before 2.78.6-3
2.78.6-3
glib
Alpaquita:25
 2.84.2-r0 up to 2.84.3-r0
2.84.3-r0
glib
Alpaquita:stream
 2.76.0-r1 up to 2.84.3-r0
2.84.3-r0
java
Bitnami
 before 1.8.0, 1.9.0 up to 8.0.481
1.8.08.0.481
java-min
Bitnami
 before 1.8.0, 1.9.0 up to 8.0.481
1.8.08.0.481
jre
Bitnami
 before 1.8.0, 1.9.0 up to 8.0.481
1.8.08.0.481
glib2.0
Debian:13
 before 2.84.3-1
2.84.3-1
glib2.0
Debian:14
 before 2.84.3-1
2.84.3-1
Glib_jll
Julia
 2.76.5+0 up to 2.86.0+0
2.86.0+0
glib2.0
Mageia:9
 before 2.76.3-1.5.mga9
2.76.3-1.5.mga9
Show 14 moreShow less
Affected packages
PackageAffectedFixed
glib2
openEuler:24.03-LTS
 before 2.78.3-9.oe2403
2.78.3-9.oe2403
glib2
openEuler:24.03-LTS-SP1
 before 2.78.3-9.oe2403sp1
2.78.3-9.oe2403sp1
glib2
openEuler:24.03-LTS-SP2
 before 2.78.3-9.oe2403sp2
2.78.3-9.oe2403sp2
glib2
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 2 CVEs
 before 2.78.6-150600.4.16.1
2.78.6-150600.4.16.1
glib2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.78.6-150600.4.16.1
2.78.6-150600.4.16.1
glib2
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 2.78.6-150600.4.16.1
2.78.6-150600.4.16.1
glib2-doc
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 2.78.6-150600.4.16.1
2.78.6-150600.4.16.1
glib2
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 2.76.2-9.1
2.76.2-9.1
glib2
SUSE:Linux Micro 6.1
 before 2.78.6-slfo.1.1_4.1
2.78.6-slfo.1.1_4.1
glib2.0
Ubuntu:24.04:LTS
 before 2.80.0-6ubuntu3.6, plus listed versions
2.78.0-22.78.1-42.78.3-12.78.3-22.79.1-1
Show 8 moreShow less
2.79.2-1~ubuntu12.79.3-3ubuntu52.80.0-6ubuntu12.80.0-6ubuntu32.80.0-6ubuntu3.12.80.0-6ubuntu3.22.80.0-6ubuntu3.42.80.0-6ubuntu3.5
2.80.0-6ubuntu3.6
glib2.0
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 2.72.4-0ubuntu2.7, plus listed versions
2.68.4-1ubuntu12.70.1-12.70.2-12.71.0-22.71.1-1
Show 11 moreShow less
2.71.2-12.71.3-12.72.0-12.72.1-12.72.4-0ubuntu12.72.4-0ubuntu22.72.4-0ubuntu2.22.72.4-0ubuntu2.32.72.4-0ubuntu2.42.72.4-0ubuntu2.52.72.4-0ubuntu2.6
2.72.4-0ubuntu2.7
glib2.0
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 2.80.0-6ubuntu3.6, plus listed versions
2.78.0-22.78.1-42.78.3-12.78.3-22.79.1-1
Show 8 moreShow less
2.79.2-1~ubuntu12.79.3-3ubuntu52.80.0-6ubuntu12.80.0-6ubuntu32.80.0-6ubuntu3.12.80.0-6ubuntu3.22.80.0-6ubuntu3.42.80.0-6ubuntu3.5
2.80.0-6ubuntu3.6
glib2.0
Ubuntu:25.10
From an advisory covering 5 CVEs
 before 2.86.0-2ubuntu0.1, plus listed versions
2.84.1-12.84.1-22.84.2-12.84.3-12.85.1-22.85.2-22.85.3-12.86.0-2
2.86.0-2ubuntu0.1
glib2
openSUSE:Tumbleweed
 before 2.84.3-1.1
2.84.3-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-6052 is a low vulnerability (CVSS 3.7) in Gnome Glib, published June 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in glib 2.78.6-3.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open