Vulnerability Details CVE-2025-13601
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 24.7%
CVSS Severity
CVSS v3 Score 7.7
Products affected by CVE-2025-13601
-
cpe:2.3:a:redhat:ceph_storage:8.0
-
cpe:2.3:a:redhat:codeready_linux_builder:9.0
-
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:10.0
-
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0
-
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:10.0
-
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:10.0_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.4_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.6_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:10.0_s390x
-
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:10.0_ppc64le
-
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le
-
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.4_ppc64le
-
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:10.0_ppc64le
-
cpe:2.3:a:redhat:codeready_linux_builder_for_x86_64:10.0
-
cpe:2.3:a:redhat:codeready_linux_builder_for_x86_64:8.0
-
cpe:2.3:a:redhat:codeready_linux_builder_for_x86_64:9.6
-
cpe:2.3:a:redhat:codeready_linux_builder_for_x86_64_eus:10.0
-
cpe:2.3:a:redhat:discovery:2.0
-
cpe:2.3:a:redhat:openshift_container_platform:4.12
-
cpe:2.3:a:redhat:openshift_container_platform:4.16
-
cpe:2.3:a:redhat:openshift_container_platform:4.19
-
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.12
-
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.16
-
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.18
-
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.19
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.12
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.16
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.17
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.18
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.19
-
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.12
-
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.16
-
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.17
-
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.18
-
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.12
-
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.16
-
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.17
-
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.18
-
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.19
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:10.0
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.4
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.6
-
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:10.0
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.2_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.4_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.6_s390x
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.4_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.6_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:10.0
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:8.0
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:8.6
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:8.8
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:9.2
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:9.4
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64:9.6
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64_eus:10.0
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64_eus:8.4
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64_eus:8.6
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64_eus:8.8
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64_eus:9.4
-
cpe:2.3:o:redhat:enterprise_linux_for_x86_64_eus:9.6
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6
-
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian:10.0_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian:8.6_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian:8.8_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian:9.4_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian:9.6_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_eus:9.4_ppc64le
-
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6
-
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8