CVE-2025-4373

An integer overflow leading to a buffer underwrite was found in GLib, affecting the glib2 package and other components in Red Hat Enterprise Linux and Fedora; Red Hat rates this flaw Moderate severity. The flaw is in the g_string_insert_unichar() function: when a GLib-based application inserts a character at a very large position within a GString, the position value overflows and the character is written before the start of the string's buffer, corrupting memory outside the intended buffer. Exploitation requires an attacker to influence the insertion position passed by a vulnerable application; successful exploitation could result in limited data corruption or an application crash. The Red Hat severity assessment (Moderate, CVSS 3.1 score 4.8) is consistent with the CVE.org rating. In Red Hat Enterprise Linux, the glib2 package is affected and a fix is being pursued through the standard update process for the affected streams. Additional Red Hat Enterprise Linux components affected by the same flaw, along with the glib2 package in the RHEL 6 and RHEL 7 extended lifecycle support streams, currently have their fixes deferred to a future update; those products remain affected in the meantime, leaving the residual risk that an application passes an attacker-influenced insertion position to g_string_insert_unichar(). Fedora is also affected, with remediation delegated to the Fedora community maintainers.