Skip to content
fr Sign in
6.1 Medium

CVE-2025-14104 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Description

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Affected products and versions

Product Affected versions Fixed in
util-linux 2.41 earliest → < 2.41.3 2.41.3
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Insights proxy 1.5 1770740405 earliest → < 1770740405 1770740405
Red Hat Update Infrastructure 5 1773670137 earliest → < 1773670137 1773670137
Show the 7 other branches
Product Affected versions Fixed in
Red Hat Ceph Storage 8 1770630907 earliest → < 1770630907 1770630907
Red Hat Ceph Storage 7 1770632724 earliest → < 1770632724 1770632724
Red Hat Ceph Storage 9 1771816028 earliest → < 1771816028 1771816028
Red Hat Hardened Images 1 Versions not published
Red Hat Hardened Images 2.42 earliest → < 2.42-7.1.hum1 2.42-7.1.hum1
Red Hat In-Vehicle Operating System 1 Versions not published
Cert Manager support for Red Hat OpenShift release 1.18 1791966259 earliest → < 1791966259 1791966259

References

Timeline

  1. Published
  2. Last modified

Other CVEs of util-linux

The 7 CVEs of util-linux →
CVE-2026-53615 util-linux is a random collection of Linux utilities 8.0 High CVE-2026-53614 util-linux is a random collection of Linux utilities 7.0 High CVE-2026-53613 util-linux is a random collection of Linux utilities 7.0 High CVE-2026-53612 util-linux is a random collection of Linux utilities 7.0 High
Track this CVE