Heap-based buffer overflow in Util-linux - CVE-2025-14104

Vulnerability identifier: #VU119955

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2025-14104

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
Util-linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Basesystem Module
Server Applications Module
openSUSE Leap
openEuler
Netezza Appliance
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Oracle Communications Cloud Native Core Certificate Management
AppDynamics NodeJS Agent
Oracle Communications Cloud Native Core Console
uuidd
util-linux-user
util-linux
python3-libmount
libuuid-devel
libuuid
libsmartcols-devel
libsmartcols
libmount-devel
libmount
libfdisk-devel
libfdisk
libblkid-devel
libblkid
libmount1-debuginfo
libsmartcols1-debuginfo
libblkid1
util-linux-systemd-debuginfo
util-linux-systemd-debugsource
libmount1
libblkid1-32bit
python-libmount
libmount1-32bit
libblkid1-debuginfo-32bit
util-linux-systemd
python-libmount-debugsource
util-linux-lang
libblkid1-debuginfo
util-linux-debugsource
libuuid1
libfdisk1
libuuid1-32bit
util-linux-debuginfo
python-libmount-debuginfo
libuuid1-debuginfo-32bit
libuuid1-debuginfo
libfdisk1-debuginfo
libmount1-debuginfo-32bit
libsmartcols1
uuidd-debuginfo
util-linux-help
util-linux-devel
libfdisk1-32bit-debuginfo
libblkid1-32bit-debuginfo
libblkid-devel-32bit
libmount-devel-32bit
libuuid-devel-32bit
libfdisk-devel-32bit
libuuid1-32bit-debuginfo
libsmartcols1-32bit
libmount1-32bit-debuginfo
python3-libmount-debugsource
libuuid-devel-static
libsmartcols1-64bit
libblkid1-64bit
libuuid1-64bit
libfdisk1-64bit-debuginfo
libblkid-devel-64bit
libsmartcols1-64bit-debuginfo
libuuid1-64bit-debuginfo
libfdisk1-64bit
libmount-devel-64bit
libuuid-devel-64bit
libmount1-64bit
libmount1-64bit-debuginfo
libfdisk-devel-64bit
libsmartcols-devel-64bit
libblkid1-64bit-debuginfo
libsmartcols-devel-32bit
libsmartcols1-32bit-debuginfo
libfdisk1-32bit
libblkid-devel-static
python3-libmount-debuginfo
libsmartcols-devel-static
libmount-devel-static
libfdisk-devel-static
util-linux-extra-debuginfo
util-linux-extra
util-linux-i18n
util-linux-core
util-linux-tty-tools
util-linux-tty-tools-debuginfo
util-linux (Red Hat package)
Juniper Junos Space

The vulnerability allows a local user to escalate privileges on the system. 

The vulnerability exists due to a boundary error when processing 256-byte usernames within the setpwnam() function. A local user can trigger a heap-based buffer overflow and execute arbitrary code on the target system.

The vulnerability affects any SUID login-utils utility writing to password database.

Install update from vendor's website.

• https://access.redhat.com/security/cve/CVE-2025-14104
• https://bugzilla.redhat.com/show_bug.cgi?id=2419369