vulnerability
Red Hat: CVE-2025-14104: util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:L/Au:S/C:P/I:N/A:C) | Dec 5, 2025 | Feb 3, 2026 | Feb 3, 2026 |
Severity
5
CVSS
(AV:L/AC:L/Au:S/C:P/I:N/A:C)
Published
Dec 5, 2025
Added
Feb 3, 2026
Modified
Feb 3, 2026
Description
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
Solutions
redhat-upgrade-libblkidredhat-upgrade-libblkid-debuginforedhat-upgrade-libblkid-develredhat-upgrade-libfdiskredhat-upgrade-libfdisk-debuginforedhat-upgrade-libfdisk-develredhat-upgrade-libmountredhat-upgrade-libmount-debuginforedhat-upgrade-libmount-develredhat-upgrade-libsmartcolsredhat-upgrade-libsmartcols-debuginforedhat-upgrade-libsmartcols-develredhat-upgrade-libuuidredhat-upgrade-libuuid-debuginforedhat-upgrade-libuuid-develredhat-upgrade-python3-libmountredhat-upgrade-python3-libmount-debuginforedhat-upgrade-util-linuxredhat-upgrade-util-linux-coreredhat-upgrade-util-linux-core-debuginforedhat-upgrade-util-linux-debuginforedhat-upgrade-util-linux-debugsourceredhat-upgrade-uuiddredhat-upgrade-uuidd-debuginfo
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.