The Red Hat Insights proxy container uses GLib libraries that contain two vulnerabilities: CVE-2025-14087, a buffer underflow in the GVariant parser causing heap corruption, and CVE-2025-14512, an integer overflow in GLib GIO attribute escaping leading to heap buffer overflow. These vulnerabilities affect Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products across multiple architectures. Red Hat has issued a security advisory (RHSA-2026:19567) with updated glib2 packages that fix these issues. The CVSS base score for CVE-2025-14087 is 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating network attack vector with high attack complexity and low impact on confidentiality, integrity, and availability.

Successful exploitation of these vulnerabilities could result in heap corruption or heap buffer overflow, potentially leading to denial of service or limited code execution capabilities. The impact is rated moderate by Red Hat, with low confidentiality, integrity, and availability impacts according to the CVSS vector. There are no known exploits in the wild at this time.

Red Hat has released updated glib2 packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products should apply the security update as described in Red Hat advisory RHSA-2026:19567. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.