CVE-2025-14087 is a medium severity flaw (CVSS 5.6) in GLib. A buffer underflow in the GVariant parser can corrupt the heap when it parses crafted input. Install your distribution's patched glib2 package. Red Hat has shipped errata for RHEL 8, 9 and 10, so check your distribution's advisory.
What's affected
GLib is the core C library used across GNOME and many Linux programs, so the affected population is every program that links it and calls the GVariant parser on untrusted text. Red Hat's advisory says the problem affects applications that use g_variant_parse() on untrusted data.
Affected version: see the Red Hat and distribution advisories for package builds. Red Hat has published errata for several RHEL releases. The record does not name an upstream fixed version, so check your distribution's advisory.
The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The weakness classes are CWE-190.
How to check if you're exposed
Check the installed package and whether your distribution has applied the fix.
rpm -q glib2
rpm -q --changelog glib2 | grep CVE-2025-14087
On Debian or Ubuntu, use the equivalent commands.
dpkg -l libglib2.0-0 | tail -1
apt changelog libglib2.0-0 | grep CVE-2025-14087
If the changelog mentions the CVE, your build includes the fix. For containers, run the same checks inside each image, since base images carry their own copy of the library. Safeguard's free dependency scan at https://gold.safeguard.sh/scan can help you see which of your manifests pull in affected packages.
What to do now
- Check your Red Hat based systems against RHSA-2026:15953 (RHEL 8) and the related errata for RHEL 9 and 10. The RHEL 8 advisory lists glib2-2.56.4-169.el8_10.
- Apply the glib2 update and restart services that use the library. Long-running processes keep the old copy in memory until they restart.
- For other distributions, look for their own advisory for CVE-2025-14087 and install the patched libglib package.
- Rebuild and redeploy container images that bundle GLib, and check base image tags.
- Identify programs that parse GVariant text from users or from the network. They are the ones where this matters most.
Why it matters
The record classifies the flaw as an integer overflow (CWE-190) that leads to a buffer underflow in the GVariant text parser, which corrupts heap memory. Heap corruption in a widely shared library can mean a crash or, in some conditions, code execution.
Red Hat's own statement says the highest threat is to availability, with crashes when applications parse crafted input through g_variant_parse(). The attack complexity in the vector is high, which is what keeps the score at 5.6. For most systems, installing the vendor update in the normal patch cycle is the right response.
Try it yourself
The demo shows how to see which findings already have a fix you can apply today.
Click through it at your own pace, or open it full screen.
Quick check
Does every Linux machine need an emergency patch?
Probably not. Red Hat describes the flaw as affecting applications that parse untrusted data with g_variant_parse(), and rates the related update as Moderate. Patch in the normal cycle, sooner if you run such software.
Why restart services after the update?
A running process keeps the old shared library mapped until it restarts, so the fix does not apply to it until then.
Sources
- Gold vulnerability page for CVE-2025-14087
- CVE record for CVE-2025-14087 as published by its CNA, with a published date of 2025-12-10
- Red Hat errata RHSA-2026:15953
- Red Hat CVE page for CVE-2025-14087
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
