CVE-2023-32643 Memory corruption in glib
A heap buffer overflow in GLib's GVariant deserialization allows attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-32643?
CVE-2023-32643 is a medium-severity memory corruption vulnerability in glib, published on 14 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.
Which versions are affected by CVE-2023-32643?
It affects 1 product.
Products include Gnome Glib.
How do I fix CVE-2023-32643?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-32643 being exploited?
There is no known exploitation of CVE-2023-32643 in the wild and no public exploit code.
Other vulnerabilities in glib
- CVE-2020-35457 Integer overflow in n/a
- CVE-2009-3289 Privilege escalation in n/a
- CVE-2025-13601 Glib: integer overflow in in g_escape_uri_string()
- CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
- CVE-2025-4056 Glib: glib crash after long command line
Sources
Also known as AZL-28777, GHSA-8jhw-fpw9-r227, JLSEC-2025-163, UBUNTU-CVE-2023-32643.