Red Hat Product Security released an advisory for two vulnerabilities in the GLib library, which provides core application building blocks for C libraries and applications, including GNOME components. CVE-2025-14087 is a buffer underflow in the GVariant parser that results in heap corruption. CVE-2025-14512 is an integer overflow in GLib GIO attribute escaping that causes a heap buffer overflow. Both vulnerabilities affect Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products across multiple architectures. The advisory rates these issues as moderate severity and provides updated glib2 packages to remediate the vulnerabilities. No CVSS scores are provided in the advisory, and no known active exploits have been reported.

Exploitation of these vulnerabilities could lead to heap corruption or heap buffer overflow conditions within applications using GLib, potentially causing application crashes or memory corruption. The advisory does not provide details on exploitation complexity or impact beyond these technical effects. No known exploits in the wild have been reported. The vulnerabilities affect multiple Red Hat Enterprise Linux 10 variants and CodeReady Linux Builder across various hardware architectures.

Red Hat has released updated glib2 packages that address these vulnerabilities for Red Hat Enterprise Linux 10 and related products. Users should apply the official security update as described in the Red Hat advisory (RHSA-2026:15969) and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated.