CVE-2025-6052 Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring

What is CVE-2025-6052?

CVE-2025-6052 is a low-severity vulnerability in Red Hat Enterprise Linux 10, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Weakness: CWE-190

Which versions are affected by CVE-2025-6052?

3 open source packages ship an affected version, including java, java-min and jre. It affects 1 product.

Products include Gnome Glib.

How do I fix CVE-2025-6052?

Upgrade java to a fixed version for your release line: 1.8.0 or 8.0.481.

Is CVE-2025-6052 being exploited?

There is no known exploitation of CVE-2025-6052 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Enterprise Linux 10

• CVE-2020-35457 Integer overflow in n/a High 7.8
• CVE-2009-3289 Privilege escalation in n/a High 7.8
• CVE-2025-13601 Glib: integer overflow in in g_escape_uri_string() High 7.7
• CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" High 7.5
• CVE-2025-4056 Glib: glib crash after long command line High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-63912, BELL-CVE-2025-6052, BIT-java-2025-6052, BIT-java-min-2025-6052, BIT-jre-2025-6052, DEBIAN-CVE-2025-6052 and 12 more.