CVE-2025-4373

mediumpriority · track · 0EPSS 0.006 · 50 %ileDEEUFRNLRUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.64% (50th) EPSS
CVSS 4.8 · medium
Is it mine?
226 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

6.5
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · CISA US
v3.14.8mediumAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · ENISA EU
v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · secalert@redhat.com USexploitability 2.2 · impact 2.5
v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · Siemens ProductCERT DE
v3.14.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)
v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L/E:Usecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USCWE-124USCWE-124USCWE-124USCWE-124USCWE-124US
05

affected products (226)

Products and version ranges known to be affected.

showing 20 of 226
06

advisories (11)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0187Kwetsbaarheden verholpen in Siemens productenNL2025-06-10csaf · ncsc_nlNL

    Siemens heeft kwetsbaarheden verholpen in diverse producten als RUGGEDCOM, SCALANCE, SIMATIC en Tecnomatix

  • NCSC-2025-0330Kwetsbaarheden verholpen in Oracle Communications productenNL2025-10-23csaf · ncsc_nlNL

    Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communications producten, waaronder de Unified Assurance en Cloud Native Core.

  • SSA-082556SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.52025-06-10csaf · siemens_psirtDE

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.

  • SSA-089022SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.32026-01-28csaf · siemens_psirtDE

    SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • WID-SEC-W-2025-1546Red Hat Enterprise Linux (GLib): Schwachstelle ermöglicht Denial of ServiceDeutsch2025-07-14csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux GLib ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • WID-SEC-W-2025-1905IBM QRadar SIEM Komponente: Mehrere SchwachstellenDeutsch2025-08-25csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM Komponenten ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

  • WID-SEC-W-2025-2361Oracle Communications: Mehrere SchwachstellenDeutsch2025-10-21csaf · cert_bundDE

    Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

  • WID-SEC-W-2026-0349Dell Avamar und NetWorker: Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Avamar und Dell NetWorker ausnutzen, um Angriffe zu starten, die die Integrität, Vertraulichkeit und Verfügbarkeit von Systemen beeinträchtigen.

  • ICSA-25-162-05Siemens SIMATIC S7-1500 CPU family2025-06-10icsa · cisa_csaf_otUS

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available.

  • ICSA-26-043-06Siemens SINEC OS2026-01-28icsa · cisa_csaf_otUS

    SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

  • CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundncsc_nlsiemens_psirtcisa_csaf_otcertfrNVDCVE.orgMITRE
published 2025-05-06modified 2026-09-21
09

references (52)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan