Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-13601

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.7, requiring local system access to exploit with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 29 products from redhat, from redhat, from redhat and 26 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2025, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2025-11-26T15:15:51.723

Last Modified

2026-03-05T12:16:10.373

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.7 (HIGH)

Weaknesses

Type: Secondary
CWE-190

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	codeready_linux_builder	9.0	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems	9.0_s390x	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian	9.0_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_x86_64	9.0	Yes
Operating System	redhat	enterprise_linux_for_arm_64	9.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	9.0_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	9.0_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	9.0	Yes
Application	redhat	codeready_linux_builder_for_arm64	10.0	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems	10.0_s390x	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian	10.0_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_x86_64	10.0	Yes
Operating System	redhat	enterprise_linux_for_arm_64	10.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	10.0_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	10.0_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	10.0	Yes
Application	redhat	codeready_linux_builder_for_arm64	8.0	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems	8.0_s390x	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian	8.0_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_x86_64	8.0	Yes
Operating System	redhat	enterprise_linux_for_arm_64	8.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	8.0_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	8.0_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	8.0	Yes
Operating System	redhat	enterprise_linux_for_arm_64	9.2	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	9.2_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	9.2_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	9.2	Yes
Operating System	redhat	enterprise_linux_server_aus	9.2	Yes
Application	redhat	codeready_linux_builder_for_arm64_eus	9.4	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems	9.4_s390x	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian	9.4_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_x86_64	9.4	Yes
Operating System	redhat	enterprise_linux_for_arm_64	9.4	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	9.4_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	9.4_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	9.4	Yes
Operating System	redhat	enterprise_linux_for_x86_64_eus	9.4	Yes
Operating System	redhat	enterprise_linux_server_aus	9.4	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian	9.4_ppc64le	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian_eus	9.4_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_arm64_eus	10.0	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems_eus	10.0_s390x	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian_eus	10.0_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_x86_64_eus	10.0	Yes
Operating System	redhat	enterprise_linux_for_arm_64_eus	10.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems_eus	10.0_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	10.0_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64_eus	10.0	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian	10.0_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_arm64	9.6	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems	9.6_s390x	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian	9.6_ppc64le	Yes
Application	redhat	codeready_linux_builder_for_x86_64	9.6	Yes
Operating System	redhat	enterprise_linux_for_arm_64	9.6	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	9.6_s390x	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	9.6_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	9.6_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	9.6	Yes
Operating System	redhat	enterprise_linux_for_x86_64_eus	9.6	Yes
Operating System	redhat	enterprise_linux_server_aus	9.6	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian	9.6_ppc64le	Yes
Operating System	redhat	enterprise_linux_for_x86_64	8.6	Yes
Operating System	redhat	enterprise_linux_for_x86_64_eus	8.6	Yes
Operating System	redhat	enterprise_linux_server_aus	8.6	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian	8.6_ppc64le	Yes
Operating System	redhat	enterprise_linux_server_tus	8.6	Yes
Operating System	redhat	enterprise_linux_for_x86_64	8.8	Yes
Operating System	redhat	enterprise_linux_for_x86_64_eus	8.8	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian	8.8_ppc64le	Yes
Operating System	redhat	enterprise_linux_server_tus	8.8	Yes
Operating System	redhat	enterprise_linux_for_x86_64_eus	8.4	Yes
Operating System	redhat	enterprise_linux_server_aus	8.4	Yes
Operating System	redhat	enterprise_linux_server_aus	8.2	Yes
Application	redhat	ceph_storage	8.0	Yes
Application	redhat	discovery	2.0	Yes
Application	gnome	glib	< 2.86.3	Yes
Application	redhat	openshift_container_platform	4.12	Yes
Application	redhat	openshift_container_platform	4.16	Yes
Application	redhat	openshift_container_platform	4.17	Yes
Application	redhat	openshift_container_platform	4.18	Yes
Application	redhat	openshift_container_platform	4.19	Yes
Application	redhat	openshift_container_platform_for_arm64	4.12	Yes
Application	redhat	openshift_container_platform_for_arm64	4.16	Yes
Application	redhat	openshift_container_platform_for_arm64	4.17	Yes
Application	redhat	openshift_container_platform_for_arm64	4.18	Yes
Application	redhat	openshift_container_platform_for_arm64	4.19	Yes
Application	redhat	openshift_container_platform_for_ibm_z	4.12	Yes
Application	redhat	openshift_container_platform_for_ibm_z	4.16	Yes
Application	redhat	openshift_container_platform_for_ibm_z	4.17	Yes
Application	redhat	openshift_container_platform_for_ibm_z	4.18	Yes
Application	redhat	openshift_container_platform_for_ibm_z	4.19	Yes
Application	redhat	openshift_container_platform_for_linuxone	4.12	Yes
Application	redhat	openshift_container_platform_for_linuxone	4.16	Yes
Application	redhat	openshift_container_platform_for_linuxone	4.17	Yes
Application	redhat	openshift_container_platform_for_linuxone	4.18	Yes
Application	redhat	openshift_container_platform_for_linuxone	4.19	Yes
Application	redhat	openshift_container_platform_for_power	4.12	Yes
Application	redhat	openshift_container_platform_for_power	4.16	Yes
Application	redhat	openshift_container_platform_for_power	4.17	Yes
Application	redhat	openshift_container_platform_for_power	4.18	Yes
Application	redhat	openshift_container_platform_for_power	4.19	Yes

References

https://access.redhat.com/errata/RHSA-2026:0936 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:0975 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:0991 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1323 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1324 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1326 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1327 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1465 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1608 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1624 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1625 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1626 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1627 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1652 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:1736 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2064 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2072 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2485 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2563 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2633 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2659 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2671 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2026:2974 ([email protected])
https://access.redhat.com/errata/RHSA-2026:3415 ([email protected])
https://access.redhat.com/security/cve/CVE-2025-13601 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2416741 Issue Tracking, Vendor Advisory ([email protected])
https://gitlab.gnome.org/GNOME/glib/-/issues/3827 Exploit, Issue Tracking ([email protected])
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914 Third Party Advisory ([email protected])

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For redhat's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.