CVE-2025-14087: 
NixOS vulnerability analysis and mitigation

CVE-2025-14087 is a buffer-underflow vulnerability in GLib's (GNOME Lib) GVariant parser that allows remote attackers to cause heap corruption, potentially leading to denial of service or arbitrary code execution. The flaw was reported on December 5, 2025, and publicly disclosed on December 10, 2025, affecting GNOME GLib versions prior to 2.86.3, as well as Red Hat Enterprise Linux 7.0–10.0, Microsoft CBL2/AZL3 GLib packages, and IBM products including App Connect Enterprise and Cloud Pak for Data System. NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while ENISA's EUVD rates it 5.6 (Medium) with higher attack complexity (Red Hat Bugzilla, Microsoft MSRC, Oracle Advisory).

The root cause is an integer overflow or wraparound (CWE-190) in GLib's GVariant parser, specifically within the bytestring_parse() and string_parse() functions. These functions use signed 32-bit integers (gint) as loop indices (i and j); when processing extremely large input strings, these counters overflow into negative values, causing the parser to write to memory before the start of the allocated buffer (str[j++]). This classic out-of-bounds write results in heap corruption. Because GVariant parsing is frequently performed on attacker-influenced data (e.g., data received over a network), a remote, unauthenticated attacker can trigger this condition by sending maliciously crafted input strings without requiring any user interaction (Red Hat Bugzilla).

Successful exploitation can result in heap corruption that causes a crash (denial of service) or, in more severe scenarios, arbitrary code execution with the privileges of the affected application. Because GLib is a foundational library used across many Linux applications and services, the blast radius is broad — any application that parses attacker-controlled GVariant data is potentially affected. Confidentiality, integrity, and availability are all at risk, and exploitation could enable lateral movement if the compromised process has elevated privileges or network access to other systems (Red Hat Bugzilla, Microsoft MSRC).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0026 (0.26%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection signatures are available from multiple scanners including Nessus and Qualys.

1. Reconnaissance: Identify applications or services that use GLib's GVariant parser and accept attacker-controlled input over the network (e.g., D-Bus services, GNOME applications with network-facing components, or custom applications using g_variant_parse()).
2. Craft malicious input: Construct an extremely large GVariant-formatted string designed to cause the signed 32-bit loop index (i or j) in bytestring_parse() or string_parse() to overflow into a negative value.
3. Deliver payload: Send the crafted string to the target application via the relevant network protocol or IPC mechanism (e.g., D-Bus message, network socket, or file input) that feeds into the GVariant parser.
4. Trigger heap corruption: The overflowed index causes the parser to write data before the start of the allocated buffer, corrupting heap metadata or adjacent allocations.
5. Achieve objective: Depending on heap layout and application context, the attacker may cause a crash (DoS) or, with additional heap-shaping techniques, achieve arbitrary code execution at the privilege level of the target process (Red Hat Bugzilla).

• Logs: Application crash logs or core dumps from processes using GLib, particularly those involving GVariant parsing; error messages referencing bytestring_parse() or string_parse() in GLib stack traces.
• Process: Unexpected crashes or restarts of GNOME applications, D-Bus services, or other GLib-dependent processes; abnormal process termination signals (SIGSEGV, SIGABRT) from GLib-linked binaries.
• Network: Unusually large or malformed GVariant-formatted data received by network-facing services that use GLib; anomalous traffic patterns targeting D-Bus or application-specific ports.
• File System: Unexpected core dump files (core.*) in application working directories following crashes of GLib-dependent services.

The primary remediation is to upgrade GLib to version 2.86.3 or later, which contains the upstream fix confirmed by maintainers. Vendor-specific patches are available: Microsoft released updates for CBL2/AZL3 GLib packages on December 13, 2025; Oracle released Solaris patches on January 20, 2026; Red Hat addressed the issue across RHEL 7–10 via multiple errata (RHSA-2026:15953, RHSA-2026:15969, RHSA-2026:15971, and subsequent EUS/SAP advisories) starting May 11, 2026; IBM released fixes for App Connect Enterprise and Cloud Pak for Data System in June 2026. As a temporary workaround, restrict network access to services that parse attacker-controlled GVariant data until patches can be applied (Microsoft MSRC, Oracle Advisory, Red Hat Bugzilla).

Red Hat initially deferred the fix (noted in February 2026 in the Bugzilla thread) before releasing patches in May 2026, which drew some community attention given the critical NVD score. The discrepancy between NVD's CVSS 9.8 (Critical) and ENISA's 5.6 (Medium, with higher attack complexity) generated discussion about scoring methodology. Coverage appeared in Linux security news outlets and distribution security advisories across Debian, Ubuntu, SUSE, Fedora, Mageia, and AlmaLinux, reflecting the broad impact of the foundational GLib library (Red Hat Bugzilla).