CVE-2025-60019: Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-25 · updated 2026-10-18
Weakness: CWE-476

Description

glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.

References

https://access.redhat.com/security/cve/CVE-2025-60019
https://bugzilla.redhat.com/show_bug.cgi?id=2398140
https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227

Get alerted when CVE-2025-60019 or the next vulnerability affects your stack