CVE-2025-13601 Glib: integer overflow in in g_escape_uri_string()
An integer overflow in glib's URI escaping function can lead to heap buffer overflows, potentially allowing code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13601?
CVE-2025-13601 is a high-severity vulnerability in Redhat Enterprise Linux for Ibm Z Systems, published on 26 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Weakness: CWE-190
Which versions are affected by CVE-2025-13601?
It affects 29 products.
Linux distribution packages (40)
glib2 AlmaLinux:10 | All versions | 2.80.4-10.el10_1.12 |
glib2-devel AlmaLinux:10 | All versions | 2.80.4-10.el10_1.12 |
glib2-doc AlmaLinux:10 | All versions | 2.80.4-10.el10_1.12 |
glib2-static AlmaLinux:10 | All versions | 2.80.4-10.el10_1.12 |
glib2-tests AlmaLinux:10 | All versions | 2.80.4-10.el10_1.12 |
mingw32-glib2 AlmaLinux:10 | All versions | 2.87.0-1.el10 |
mingw32-glib2-static AlmaLinux:10 | All versions | 2.87.0-1.el10 |
mingw64-glib2 AlmaLinux:10 | All versions | 2.87.0-1.el10 |
mingw64-glib2-static AlmaLinux:10 | All versions | 2.87.0-1.el10 |
glib2 AlmaLinux:8 | All versions | 2.56.4-168.el8_10 |
glib2-devel AlmaLinux:8 | All versions | 2.56.4-168.el8_10 |
glib2-doc AlmaLinux:8 | All versions | 2.56.4-168.el8_10 |
glib2-fam AlmaLinux:8 | All versions | 2.56.4-168.el8_10 |
glib2-static AlmaLinux:8 | All versions | 2.56.4-168.el8_10 |
glib2-tests AlmaLinux:8 | All versions | 2.56.4-168.el8_10 |
glib2 AlmaLinux:9 | All versions | 2.68.4-18.el9_7.1 |
glib2-devel AlmaLinux:9 | All versions | 2.68.4-18.el9_7.1 |
glib2-doc AlmaLinux:9 | All versions | 2.68.4-18.el9_7.1 |
glib2-static AlmaLinux:9 | All versions | 2.68.4-18.el9_7.1 |
glib2-tests AlmaLinux:9 | All versions | 2.68.4-18.el9_7.1 |
mingw32-glib2 AlmaLinux:9 | All versions | 2.78.6-3.el9 |
mingw32-glib2-static AlmaLinux:9 | All versions | 2.78.6-3.el9 |
mingw64-glib2 AlmaLinux:9 | All versions | 2.78.6-3.el9 |
mingw64-glib2-static AlmaLinux:9 | All versions | 2.78.6-3.el9 |
glib2 Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-devel Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-devel-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-doc Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-static Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-tests Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
glib2-tests-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:2.80.4-10.el10_1.12 |
mingw-glib2 Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
mingw32-glib2 Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
mingw32-glib2-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
mingw32-glib2-static Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
mingw64-glib2 Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
mingw64-glib2-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
mingw64-glib2-static Red Hat:enterprise_linux:10.2 | All versions | 0:2.87.0-1.el10 |
Products include Gnome Glib, Redhat Ceph Storage, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder for Arm64, Redhat Codeready Linux Builder for Arm64 Eus, Redhat Codeready Linux Builder for Ibm Z Systems and 23 more.
How do I fix CVE-2025-13601?
Apply the vendor's patch.
Is CVE-2025-13601 being exploited?
There is no known exploitation of CVE-2025-13601 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux for Ibm Z Systems
- CVE-2020-35457 Integer overflow in n/a
- CVE-2009-3289 Privilege escalation in n/a
- CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
- CVE-2025-4056 Glib: glib crash after long command line
- CVE-2019-13012 Misconfiguration in n/a
All Redhat Enterprise Linux for Ibm Z Systems vulnerabilities
Sources
Also known as ALSA-2026:0936, ALSA-2026:0975, ALSA-2026:0991, ALSA-2026:18344, ALSA-2026:18705, AZL-71095 and 45 more.