Out-of-bounds read in Gnome GLib - CVE-2025-7039

Vulnerability identifier: #VU113803

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-7039

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
Gnome GLib
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Micro
Ubuntu
Basesystem Module
openSUSE Leap
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
openEuler
Anolis OS
Fedora
glib2.0 (Ubuntu package)
glib2-lang
glib2-tools
libgthread-2_0-0-debuginfo-32bit
libgmodule-2_0-0-debuginfo-32bit
libgobject-2_0-0-debuginfo-32bit
libgmodule-2_0-0-debuginfo
libglib-2_0-0
libgio-2_0-0
libglib-2_0-0-debuginfo
glib2-devel
libgio-2_0-0-32bit
glib2-debugsource
libgobject-2_0-0
libglib-2_0-0-32bit
libgio-2_0-0-debuginfo-32bit
glib2-tools-debuginfo
glib2-devel-debuginfo
libgmodule-2_0-0
libgio-2_0-0-debuginfo
libgmodule-2_0-0-32bit
libgobject-2_0-0-debuginfo
libgthread-2_0-0
glib2-devel-static
libgthread-2_0-0-debuginfo
libgthread-2_0-0-32bit
libglib-2_0-0-debuginfo-32bit
libgobject-2_0-0-32bit
glib2
glib2-debuginfo
glib2-help
glib2-devel-32bit
libgmodule-2_0-0-64bit-debuginfo
libgthread-2_0-0-64bit
libgthread-2_0-0-64bit-debuginfo
libgio-2_0-0-64bit-debuginfo
libglib-2_0-0-64bit
libgmodule-2_0-0-64bit
glib2-devel-64bit
glib2-tools-64bit
libglib-2_0-0-64bit-debuginfo
libgobject-2_0-0-64bit
glib2-devel-64bit-debuginfo
libgobject-2_0-0-64bit-debuginfo
glib2-tools-64bit-debuginfo
libgio-2_0-0-64bit
libgmodule-2_0-0-32bit-debuginfo
glib2-tests-devel
glib2-tools-32bit-debuginfo
glib2-tests-devel-debuginfo
libglib-2_0-0-32bit-debuginfo
glib2-tools-32bit
libgthread-2_0-0-32bit-debuginfo
libgobject-2_0-0-32bit-debuginfo
libgio-2_0-0-32bit-debuginfo
glib2-devel-32bit-debuginfo
gio-branding-upstream
glib2-doc
glib2-tests
glib2-static
libgirepository-2_0-0-debuginfo
typelib-1_0-GLib-2_0
libgirepository-2_0-0
typelib-1_0-Gio-2_0
typelib-1_0-GModule-2_0
typelib-1_0-GObject-2_0
typelib-1_0-GIRepository-3_0
typelib-1_0-GLibUnix-2_0
gio-branding-SLE

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the  get_tmp_file() function in glib/gfileutils.c. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://bodhi.fedoraproject.org/updates/FEDORA-2025-16acfe9927