Glib: integer overflow in in g_escape_uri_string()

Summary

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

Timeline

1. Nov 26, 2025, 2:44 PM UTCCVE published
2. Nov 26, 2025, 2:58 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 31, 2026, 5:02 PM UTCRecord last updated

Affected versions

• glib

  fixed in 2.86.3

• glib2

  Version range not reported

• mingw-glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• mingw-glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhceph/rhceph-8-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• glib2-main

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• glib2

  Version range not reported

• mingw-glib2

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 25