CVE-2025-4373

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

An integer overflow leading to a buffer underwrite was found in GLib, affecting the glib2 package and other components in Red Hat Enterprise Linux and Fedora; Red Hat rates this flaw Moderate severity. The flaw is in the g_string_insert_unichar() function: when a GLib-based application inserts a character at a very large position within a GString, the position value overflows and the character is written before the start of the string's buffer, corrupting memory outside the intended buffer. Exploitation requires an attacker to influence the insertion position passed by a vulnerable application; successful exploitation could result in limited data corruption or an application crash. The Red Hat severity assessment (Moderate, CVSS 3.1 score 4.8) is consistent with the CVE.org rating. In Red Hat Enterprise Linux, the glib2 package is affected and a fix is being pursued through the standard update process for the affected streams. Additional Red Hat Enterprise Linux components affected by the same flaw, along with the glib2 package in the RHEL 6 and RHEL 7 extended lifecycle support streams, currently have their fixes deferred to a future update; those products remain affected in the meantime, leaving the residual risk that an application passes an attacker-influenced insertion position to g_string_insert_unichar(). Fedora is also affected, with remediation delegated to the Fedora community maintainers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Currently, no mitigation is available for this vulnerability.