CVE-2025-4373 Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar
An integer overflow in GLib's g_string_insert_unichar function allows attackers to trigger a buffer underwrite, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4373?
CVE-2025-4373 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 6 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.
Weakness: CWE-124
Which versions are affected by CVE-2025-4373?
Linux distribution packages (6)
glib2 SUSE:Linux Enterprise Micro 5.1 | All versions | 2.62.6-150200.3.30.1 |
glib2 SUSE:Linux Enterprise Micro 5.2 | All versions | 2.62.6-150200.3.30.1 |
glib2 SUSE:Linux Enterprise Micro 5.3 | All versions | 2.70.5-150400.3.23.1 |
glib2 SUSE:Linux Enterprise Micro 5.4 | All versions | 2.70.5-150400.3.23.1 |
glib2 SUSE:Linux Enterprise Micro 5.5 | All versions | 2.70.5-150400.3.23.1 |
glib2 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.48.2-12.46.1 |
How do I fix CVE-2025-4373?
Apply the vendor's patch.
Is CVE-2025-4373 being exploited?
There is no known exploitation of CVE-2025-4373 in the wild and no public exploit code.
Sources
Also known as AZL-62286, AZL-62295, BELL-CVE-2025-4373, CLSA-2025-1753768618, CLSA-2025-1753768865, CLSA-2025-1753769031 and 14 more.