CVE-2025-14104CWE-125

CVE-2025-14104

Medium · published December 5, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-12-05T22:16Z
References (16)
https://access.redhat.com/errata/RHSA-2026:1696 · [email protected]https://access.redhat.com/errata/RHSA-2026:1852 · [email protected]https://access.redhat.com/errata/RHSA-2026:1913 · [email protected]https://access.redhat.com/errata/RHSA-2026:2485 · [email protected]https://access.redhat.com/errata/RHSA-2026:2563 · [email protected]https://access.redhat.com/errata/RHSA-2026:2737 · [email protected]https://access.redhat.com/errata/RHSA-2026:2800 · [email protected]https://access.redhat.com/errata/RHSA-2026:3406 · [email protected]https://access.redhat.com/errata/RHSA-2026:4943 · [email protected]https://access.redhat.com/errata/RHSA-2026:7180 · [email protected]https://access.redhat.com/errata/RHSA-2026:82347 · [email protected]https://access.redhat.com/errata/RHSA-2026:82354 · [email protected]https://access.redhat.com/errata/RHSA-2026:82372 · [email protected]https://access.redhat.com/errata/RHSA-2026:82857 · [email protected]https://access.redhat.com/security/cve/CVE-2025-14104 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2419369 · [email protected]
EPSS history
Timeline
  • 05 DEC 16:22Z
    Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
    cvelistv5