CVE-2025-14087

Medium

Published: 10 December 2025

Published

10 December 2025

Modified

19 April 2026

KEV Added

—

Patch

—

CVSS Score 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0004 13.6th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14087 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation directly addresses the buffer underflow vulnerability by applying vendor patches like RHSA-2026:7461 to update the vulnerable GLib GVariant parser.

SI-16 Memory Protection good match

prevent

Memory protection mechanisms such as ASLR and non-executable heap pages prevent exploitation of heap corruption for code execution or denial of service.

SI-10 Information Input Validation partial match

prevent

Information input validation rejects maliciously crafted strings before they are processed by the vulnerable GVariant parser in GLib-dependent applications.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Buffer underflow in GLib GVariant parser enables remote exploitation of public-facing applications/services using GLib, leading to heap corruption, potential code execution or DoS without privileges.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input…

strings.

Deeper analysisAI

CVE-2025-14087 is a buffer underflow vulnerability (CWE-190) in the GVariant parser of GLib, the core library used in GNOME applications and widely in Linux environments. The flaw causes heap corruption when processing maliciously crafted input strings, potentially leading to denial of service or code execution. It was published on 2025-12-10 with a CVSS v3.1 base score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).

A remote attacker can exploit this vulnerability over the network without requiring privileges or user interaction, though it demands high attack complexity. Exploitation involves feeding specially crafted strings to applications or services that parse GVariant data via GLib, resulting in heap corruption that disrupts service availability or, in some cases, enables arbitrary code execution with the privileges of the affected process.

Red Hat advisories detail mitigation through errata RHSA-2026:7461, which provides updated packages. Further technical details and patches are tracked in the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2025-14087, Bugzilla entry 2419093, and the upstream GLib issue at https://gitlab.gnome.org/GNOME/glib/-/issues/3834.