{"id":"CVE-2025-4056","aliases":["BELL-CVE-2025-4056","EUVD-2025-22903","GHSA-6gjq-8hm4-wjmq","JLSEC-2025-168","OESA-2025-1551","UBUNTU-CVE-2025-4056"],"status":"published","title":"Glib: glib crash after long command line","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00543,"percentile":0.45863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2025-04-29T05:58:45.484552Z","modified":"2026-11-06T17:43:48Z","fixes":[{"ecosystem":"Julia","package":"Glib_jll","fixed_in":["2.84.3+0"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"glib2","fixed_in":["2.72.2-21.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"glib2","fixed_in":["2.78.3-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"glib2","fixed_in":["2.78.3-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"glib2","fixed_in":["2.66.8-19.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"glib2","fixed_in":["2.72.2-21.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"Glib_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.84.3+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.2-21.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.3-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.3-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.8-19.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.2-21.oe2203sp3"}]}]}],"products":[{"vendor":"gnome","product":"glib"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-4056","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2362826","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/3668","tags":["Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4056","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6gjq-8hm4-wjmq"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-4056","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4056.json","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/glib","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1551","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4056","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-4056","title":"Glib: glib crash after long command line","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","status":"published","published":"2025-07-28T12:40:29.298Z","modified":"2026-11-06T17:43:48.318Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2025-22903","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","status":"published","published":"2025-07-28T12:40:29Z","modified":"2026-11-06T17:43:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T19:05:53.354277Z"}],"ghsa":[{"id":"GHSA-6gjq-8hm4-wjmq","title":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application...","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","status":"published","published":"2025-07-28T15:31:38Z","modified":"2025-07-28T15:31:46Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:03:07.9296Z"}],"nvd":[{"id":"CVE-2025-4056","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","status":"published","published":"2025-07-28T13:15:30.177Z","modified":"2026-11-06T18:17:19.59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-06T20:01:10.091781Z"}],"osv":[{"id":"BELL-CVE-2025-4056","title":"CVE-2025-4056 does not affect BellSoft software","status":"withdrawn","published":"2025-04-29T05:58:45.484552Z","modified":"2026-01-26T09:49:08.827046Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-4056","title":"Glib: glib crash after long command line","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","status":"published","published":"2025-07-28T12:40:29.298Z","modified":"2026-11-08T02:30:38.234866031Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-07T03:07:56.843041Z"},{"id":"JLSEC-2025-168","title":"A flaw was found in GLib","description":"A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.","status":"published","published":"2025-10-19T22:31:43.957Z","modified":"2026-07-18T00:00:53.595040765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2025-1551","title":"glib2 security update","description":"GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib\u0026amp;apos;s code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in GNU GLib up to 2.84.0 on Windows (Software Library). It has been rated as problematic. Affected by this issue is some unknown processing of the component Command Line Handler. Upgrading to version 2.84.1 eliminates this vulnerability.(CVE-2025-4056)","status":"published","published":"2025-05-23T11:08:38Z","modified":"2026-08-18T01:17:59.239721862Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-4056","description":"Integer Overflow in protect_argv_string Method","status":"withdrawn","published":"2025-05-01T00:00:00Z","modified":"2025-07-16T07:48:19.795514Z","updated_at":"2026-11-02T16:55:46.53147Z"}]}}