CVE-2025-6052: 
NixOS vulnerability analysis and mitigation

CVE-2025-6052 is an integer overflow vulnerability in GLib's g_string_maybe_expand() function that can lead to a buffer overflow in the GString data structure. When an extremely large string is combined with additional input, an internal size calculation wraps around (integer overflow), causing the system to incorrectly assume sufficient buffer space exists and subsequently write data past the end of the allocated memory region. The vulnerability affects GNOME GLib versions 2.75.3 through 2.84.3 (prior to the backported fix in 2.84.3 and the upstream fix in 2.85.1). It was disclosed on June 13, 2025, and carries a CVSS v3.1 base score of 7.5 (High) per NVD, though Red Hat and ENISA assess it lower at 3.7 (Low) due to the high-memory preconditions required (Red Hat CVE, Red Hat Bugzilla, Oracle Bulletin).

The root cause is an integer overflow (CWE-190) in the g_string_maybe_expand() function within GLib's GString implementation. When a GString already holds an extremely large amount of data and more data is appended, the internal calculation of the required buffer size overflows, wrapping around to a smaller value. This causes the allocator to believe the existing buffer is sufficient, resulting in a heap buffer overflow when data is written beyond the allocated region. The fix was committed upstream at 33d9ba2fcc907b4f9a6c0540f9976b64b6f59db2 and backported to the 2.84.x branch; a regression introduced by the initial fix was subsequently corrected in GLib 2.85.2. Exploitation requires that an application accepts very large untrusted input and processes it using GString operations, making practical exploitation difficult but theoretically possible in network-facing applications (Red Hat Bugzilla).

Successful exploitation can result in memory corruption or application crashes, primarily impacting availability. Because the overflow leads to writes past the end of the allocated heap buffer, there is a theoretical risk of memory corruption that could affect data integrity in the affected process. Confidentiality impact is assessed as none, as the vulnerability does not directly expose data. The practical impact is limited by the requirement for extremely large memory conditions, but network-facing applications that use GLib's GString for processing large untrusted inputs are at elevated risk of denial of service (Red Hat CVE, Red Hat Bugzilla).

The upstream fix is available in GLib 2.85.1 (and a regression fix in 2.85.2), with a backport applied to GLib 2.84.3. Users of affected versions (2.75.3 through the unpatched 2.84.x releases) should upgrade to GLib 2.84.3 (with the backported fix) or 2.85.2 or later. Downstream distributions including Fedora, SUSE, Ubuntu (USN-7942-1, USN-7942-2), Mageia, and Oracle Solaris 11.4 have released updated packages. IBM has also addressed this in IBM Rapid Infrastructure Automation. Organizations should prioritize patching network-facing applications that use GLib's GString API to process large untrusted inputs (Red Hat Bugzilla, Oracle Bulletin).

The vulnerability received routine coverage from Linux distribution security teams and vulnerability tracking services, with patches issued by Fedora, SUSE, Ubuntu, Mageia, and Oracle Solaris. Red Hat classified the severity as Low given the difficult exploitation preconditions, which aligns with ENISA's assessment of 3.7. No notable researcher commentary or significant social media discussion beyond standard security advisory channels has been identified.