CVE-2025-14087 Details

A buffer-underflow vulnerability has been identified in GLib's GVariant parser, specifically in the bytestring_parse() and string_parse() functions. This vulnerability allows remote attackers to cause heap corruption, leading to application crashes or potentially executing arbitrary code. The issue arises when the parser processes maliciously crafted input strings, causing signed 32-bit integer loop indices to overflow into negative values. This overflow allows the parser to write to memory before the allocated buffer, creating an out-of-bounds write condition. The vulnerability is particularly concerning because GVariant parsing is often performed on data influenced by attackers, making it exploitable in real-world scenarios.

The vulnerability has been patched upstream, but users should check with their specific distribution for the availability of the fix.