A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glib2-famUpgrade glib2-develUpgrade mingw64-glib2Upgrade mingw64-glib2-staticUpgrade glib2-staticUpgrade mingw32-glib2-staticUpgrade glib2Upgrade mingw32-glib2Upgrade glib2-testsUpgrade glib2-doc | Jan 26, 2026 | Jan 21, 2026 |
| Amazon Linux Ami 2 | — | Upgrade glib2-famUpgrade glib2-docUpgrade glib2Upgrade glib2-staticUpgrade glib2-debuginfoUpgrade glib2-testsUpgrade glib2-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade glib2-tests-debuginfoUpgrade glib2-docUpgrade glib2-devel-debuginfoUpgrade glib2-testsUpgrade glib2-develUpgrade glib2-debugsourceUpgrade glib2-staticUpgrade glib2Upgrade glib2-debuginfo | Dec 9, 2025 | Nov 24, 2025 |
| Debian | — | Upgrade glib2.0 | Dec 17, 2025 | Dec 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade glib2 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade glib2 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade glib2 | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade glib2 | Mar 10, 2026 | Mar 10, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | May 12, 2026 |
| Oracle_linux | — | Upgrade glib2-famUpgrade glib2Upgrade glib2-staticUpgrade glib2-develUpgrade glib2-docUpgrade glib2-tests | Jan 23, 2026 | Nov 24, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Nov 24, 2025 |
| Redhat_linux | — | Upgrade mingw32-glib2Upgrade mingw32-glib2-staticUpgrade glib2-devel-debuginfoNo solution existsUpgrade mingw64-glib2-staticUpgrade glib2-debugsourceUpgrade glib2-debuginfoUpgrade mingw64-glib2Upgrade glib2-docUpgrade glib2Upgrade mingw64-glib2-debuginfoUpgrade glib2-testsUpgrade mingw32-glib2-debuginfoUpgrade glib2-famUpgrade glib2-fam-debuginfoUpgrade glib2-staticUpgrade glib2-develUpgrade glib2-tests-debuginfo | Jan 23, 2026 | Nov 24, 2025 |
| Rocky_linux | — | Upgrade glib2Upgrade glib2-fam-debuginfoUpgrade glib2-tests-debuginfoUpgrade glib2-debugsourceUpgrade glib2-develUpgrade glib2-debuginfoUpgrade glib2-famUpgrade glib2-testsUpgrade glib2-devel-debuginfoUpgrade glib2-static | Jan 26, 2026 | Jan 24, 2026 |
| Ubuntu | — | Upgrade libglib2.0-0Upgrade libglib2.0-0t64Upgrade libglib2.0-binUpgrade libglib2.0-0 (Ubuntu Pro) | Jan 7, 2026 | Nov 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub