A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in…

When g_escape_uri_string() walks a candidate string and counts how many bytes the percent-encoded output will need, the running total can wrap a 32-bit size_t on platforms where the worst-case expansion (×3 per byte) of a sufficiently large input overflows the allocation size calculation. The allocator then returns a buffer smaller than the encoder thinks it asked for, and the encoder writes past the end. This affects glib (glib2) before 2.86.3, with distro backports landing as 2.66.8-1+deb11u7 (Bullseye), 2.74.6-2+deb12u8 (Bookworm), 2.84.4-3~deb13u2 (Trixie), and the upstream fix in 2.86.3-1. The flaw lives in GNOME GitLab issue #3827.

Vendor severity is HIGH (7.7) under AV:L/AC:L/PR:N/UI:N/C:N/I:H/A:H — local, no privileges, integrity + availability impact. The score is technically defensible because corruption of a heap chunk can hand an attacker code execution in the calling process, but in practice nearly every real caller of g_escape_uri_string() (GIO, GVfs, desktop URI handling, GNotification, GApplication) is invoked with attacker-controllable strings that are kilobytes, not the hundreds-of-megabytes required to wrap the length math. The realistic severity sits in MEDIUM territory: it is a latent corruption primitive looking for a caller that will hand it a giant string, and very few do.

Why this verdict

• AV:L kills network reach. The vendor's own vector confirms no remote path; the attacker must already be on the box, which collapses to a privilege-escalation primitive at best.
• No setuid / high-value-role caller. g_escape_uri_string() is invoked from desktop URI plumbing (GVfs, GIO, GNotification), GApplication, and userland apps — none of these are canonically high-value roles (no DC, hypervisor, IdP, PAM, backup, kernel agent runs URI escaping on attacker input). Role multiplier does not apply.
• Role multiplier — server fleet: glib is present on virtually every Linux server but the vulnerable function is rarely on the data path for server workloads (web servers, databases, K8s nodes don't escape attacker URIs through this helper). Chain does not succeed in the high-value role.
• Trigger size is implausible. Wrapping the length math on 64-bit requires ~6 GB of attacker-shaped input in a single allocation — instantly OOM-killed or detected by EDR on real fleets.
• EPSS 0.3% + no KEV + no PoC — there is no observed adversary interest and no weaponization to chase.

Why not higher?

HIGH would require either a remote vector (this is AV:L), a high-value-role caller (none documented), or a credible exploitation chain. The integer overflow exists but the triggering caller does not exist in the high-blast-radius components defenders care about.

Why not lower?

LOW would imply no realistic impact, but the bug IS a memory-corruption primitive in a near-ubiquitous library. If a future caller emerges that hands it large attacker-controlled input — or a 32-bit embedded build is found — the calculus changes. MEDIUM keeps it on the 365-day remediation clock rather than ignored.

1. Patch glib2 via vendor channel in next monthly window — RHEL: dnf upgrade glib2 to ≥ glib2-2.56.4-168.el8_10 (RHSA-2026:0975). Debian/Ubuntu: apt upgrade libglib2.0-0 to the per-release fixed version. Container base images: rebuild from updated upstream. No mitigation SLA at MEDIUM — fold into the noisgate remediation SLA of ≤ 365 days, but realistically ride the next maintenance window.
2. Inventory which processes actually link vulnerable glib AND escape untrusted URIs — Run lsof | grep libglib-2.0 on representative hosts and cross-reference against your application inventory. Most servers will show glib loaded by systemd, NetworkManager, polkitd — none of which feed attacker-controlled multi-GB strings to the escaper. Use the result to deprioritize hosts where the caller is not exposed.
3. Tighten desktop/Flatpak sandboxing where applicable — On user workstations, ensure Flatpak/snap confinement is enforced (flatpak override --reset) so a successful exploit stays inside the application sandbox rather than reaching the user's home dir. Useful as defense-in-depth, not a mitigation per se.
4. Add memory-allocation anomaly alerting for desktop processes — Trigger telemetry when GUI processes attempt single allocations > 1 GB or hit OOM-kill — the only realistic trigger path produces conspicuous memory pressure that a tuned EDR or auditd rule will surface.

Run on each Linux target host as any user (no privileges required). Example: bash check-cve-2025-13601.sh. Detects vulnerable glib2 package version across RHEL/Debian/Ubuntu/Amazon Linux families and prints VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# CVE-2025-13601 — glib g_escape_uri_string integer overflow
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

verdict() { echo "$1"; exit "$2"; }

ver_ge() {
  # returns 0 if $1 >= $2 using dpkg/rpm semantics where available
  if command -v dpkg >/dev/null 2>&1; then
    dpkg --compare-versions "$1" ge "$2"
    return $?
  elif command -v rpmdev-vercmp >/dev/null 2>&1; then
    rpmdev-vercmp "$1" "$2" >/dev/null 2>&1
    [ $? -eq 11 ] && return 1 || return 0
  else
    # crude fallback
    [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -1)" = "$2" ] && return 0 || return 1
  fi
}

if command -v rpm >/dev/null 2>&1; then
  PKG=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' glib2 2>/dev/null | head -1)
  [ -z "$PKG" ] && verdict "UNKNOWN: glib2 not installed via rpm" 2
  # RHEL 8 fix: 2.56.4-168.el8_10
  if echo "$PKG" | grep -q 'el8'; then
    ver_ge "$PKG" "2.56.4-168.el8_10" && verdict "PATCHED: glib2-$PKG" 0
    verdict "VULNERABLE: glib2-$PKG (need >= 2.56.4-168.el8_10)" 1
  fi
  # Generic: anything upstream >= 2.86.3 is fixed
  UPSTREAM=$(echo "$PKG" | cut -d- -f1)
  ver_ge "$UPSTREAM" "2.86.3" && verdict "PATCHED: glib2-$PKG" 0
  verdict "VULNERABLE: glib2-$PKG (need backport or >= 2.86.3 upstream)" 1
fi

if command -v dpkg >/dev/null 2>&1; then
  PKG=$(dpkg-query -W -f='${Version}\n' libglib2.0-0 libglib2.0-0t64 2>/dev/null | head -1)
  [ -z "$PKG" ] && verdict "UNKNOWN: libglib2.0-0 not installed" 2
  CODENAME=$( ( . /etc/os-release; echo "$VERSION_CODENAME" ) 2>/dev/null )
  case "$CODENAME" in
    bullseye) FIX="2.66.8-1+deb11u7" ;;
    bookworm) FIX="2.74.6-2+deb12u8" ;;
    trixie)   FIX="2.84.4-3~deb13u2" ;;
    *)        FIX="2.86.3" ;;
  esac
  ver_ge "$PKG" "$FIX" && verdict "PATCHED: libglib2.0-0 $PKG (>= $FIX)" 0
  verdict "VULNERABLE: libglib2.0-0 $PKG (need >= $FIX)" 1
fi

verdict "UNKNOWN: no supported package manager detected" 2

Sources

1. Debian Security Tracker — CVE-2025-13601
2. Debian bug #1121488 — glib#3827 / CVE-2025-13601
3. VulDB 333600 — CVE-2025-13601
4. Red Hat RHSA-2026:0975 — glib2 security update
5. Amazon Linux ALAS — CVE-2025-13601
6. IBM Security Bulletin — glib2 affects Netezza Appliance
7. Mageia MGASA-2026-0023 — glib2.0 update
8. MIRACLE LINUX — glib2-2.56.4-168.el8_10