CVE-2025-14104

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14104", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-12-05T14:18:15.840Z", "datePublished": "2025-12-05T16:22:09.283Z", "dateUpdated": "2026-11-05T14:17:35.292Z"}, "containers": {"cna": {"title": "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."}], "affected": [{"vendor": "util-linux", "product": "util-linux", "versions": [{"status": "affected", "version": "0", "lessThan": "2.41.3", "versionType": "semver"}], "packageName": "util-linux", "collectionURL": "https://github.com/util-linux/util-linux", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux", "defaultStatus": "affected", "versions": [{"version": "0:2.40.2-15.el10_1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux", "defaultStatus": "affected", "versions": [{"version": "0:2.32.1-48.el8_10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux", "defaultStatus": "affected", "versions": [{"version": "0:2.32.1-48.el8_10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux", "defaultStatus": "affected", "versions": [{"version": "0:2.37.4-21.el9_7", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux", "defaultStatus": "affected", "versions": [{"version": "0:2.37.4-21.el9_7", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9", "defaultStatus": "affected", "versions": [{"version": "1791459707", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"]}, {"vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/jetstack-cert-manager-rhel9", "defaultStatus": "affected", "versions": [{"version": "1791459711", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"]}, {"vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/cert-manager-istio-csr-rhel9", "defaultStatus": "affected", "versions": [{"version": "1791459759", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"]}, {"vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/cert-manager-operator-rhel9", "defaultStatus": "affected", "versions": [{"version": "1789029076", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"]}, {"vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/cert-manager-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "1791966259", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 7", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhceph/rhceph-7-rhel9", "defaultStatus": "affected", "versions": [{"version": "1770632724", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ceph_storage:7::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhceph/rhceph-8-rhel9", "defaultStatus": "affected", "versions": [{"version": "1770630907", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ceph_storage:8::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ceph Storage 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhceph/rhceph-9-rhel9", "defaultStatus": "affected", "versions": [{"version": "1771816028", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ceph_storage:9::el10"]}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "util-linux-main", "defaultStatus": "affected", "versions": [{"version": "2.42-7.1.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}, {"vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "insights-proxy/insights-proxy-container-rhel9", "defaultStatus": "affected", "versions": [{"version": "1770740405", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhui5/installer-rhel9", "defaultStatus": "affected", "versions": [{"version": "1770646925", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhui:5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhui5/cds-rhel9", "defaultStatus": "affected", "versions": [{"version": "1773670073", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhui:5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhui5/haproxy-rhel9", "defaultStatus": "affected", "versions": [{"version": "1773672059", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhui:5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhui5/rhua-rhel9", "defaultStatus": "affected", "versions": [{"version": "1773670137", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhui:5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux-ng", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "util-linux", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:1696", "name": "RHSA-2026:1696", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:1852", "name": "RHSA-2026:1852", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:1913", "name": "RHSA-2026:1913", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2485", "name": "RHSA-2026:2485", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2563", "name": "RHSA-2026:2563", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2737", "name": "RHSA-2026:2737", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2800", "name": "RHSA-2026:2800", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:3406", "name": "RHSA-2026:3406", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:4943", "name": "RHSA-2026:4943", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7180", "name": "RHSA-2026:7180", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82347", "name": "RHSA-2026:82347", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82354", "name": "RHSA-2026:82354", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82372", "name": "RHSA-2026:82372", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82857", "name": "RHSA-2026:82857", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-14104", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "name": "RHBZ#2419369", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2025-12-05T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-125: Out-of-bounds Read", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2025-12-05T14:16:36.004Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-05T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T14:17:35.292Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T20:03:09.994553Z", "id": "CVE-2025-14104", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T20:03:19.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14104", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T20:03:09.994553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T20:03:16.006Z"}}], "cna": {"title": "Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "util-linux", "product": "util-linux", "versions": [{"status": "affected", "version": "0", "lessThan": "2.41.3", "versionType": "semver"}], "packageName": "util-linux", "collectionURL": "https://github.com/util-linux/util-linux", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:2.40.2-15.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "util-linux", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:2.32.1-48.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "util-linux", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:2.32.1-48.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "util-linux", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.37.4-21.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "util-linux", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.37.4-21.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "util-linux", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "versions": [{"status": "unaffected", "version": "1791459707", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "versions": [{"status": "unaffected", "version": "1791459711", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/jetstack-cert-manager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "versions": [{"status": "unaffected", "version": "1791459759", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/cert-manager-istio-csr-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "versions": [{"status": "unaffected", "version": "1789029076", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/cert-manager-operator-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "vendor": "Red Hat", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "versions": [{"status": "unaffected", "version": "1791966259", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/cert-manager-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:7::el9"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 7", "versions": [{"status": "unaffected", "version": "1770632724", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhceph/rhceph-7-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:8::el9"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 8", "versions": [{"status": "unaffected", "version": "1770630907", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhceph/rhceph-8-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ceph_storage:9::el10"], "vendor": "Red Hat", "product": "Red Hat Ceph Storage 9", "versions": [{"status": "unaffected", "version": "1771816028", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhceph/rhceph-9-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "2.42-7.1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "util-linux-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "versions": [{"status": "unaffected", "version": "1770740405", "lessThan": "*", "versionType": "rpm"}], "packageName": "insights-proxy/insights-proxy-container-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhui:5::el9"], "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "versions": [{"status": "unaffected", "version": "1770646925", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhui5/installer-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhui:5::el9"], "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "versions": [{"status": "unaffected", "version": "1773670073", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhui5/cds-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhui:5::el9"], "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "versions": [{"status": "unaffected", "version": "1773672059", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhui5/haproxy-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhui:5::el9"], "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "versions": [{"status": "unaffected", "version": "1773670137", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhui5/rhua-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "util-linux-ng", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "util-linux", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2025-12-05T14:16:36.004Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-12-05T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-12-05T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:1696", "name": "RHSA-2026:1696", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:1852", "name": "RHSA-2026:1852", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:1913", "name": "RHSA-2026:1913", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2485", "name": "RHSA-2026:2485", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2563", "name": "RHSA-2026:2563", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2737", "name": "RHSA-2026:2737", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:2800", "name": "RHSA-2026:2800", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:3406", "name": "RHSA-2026:3406", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:4943", "name": "RHSA-2026:4943", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7180", "name": "RHSA-2026:7180", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82347", "name": "RHSA-2026:82347", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82354", "name": "RHSA-2026:82354", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82372", "name": "RHSA-2026:82372", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:82857", "name": "RHSA-2026:82857", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-14104", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419369", "name": "RHBZ#2419369", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T14:17:35.292Z"}, "x_redhatCweChain": "CWE-125: Out-of-bounds Read"}}, "cveMetadata": {"cveId": "CVE-2025-14104", "state": "PUBLISHED", "dateUpdated": "2026-11-05T14:17:35.292Z", "dateReserved": "2025-12-05T14:18:15.840Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-12-05T16:22:09.283Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/util-linux/util-linux", "defaultStatus": "unaffected", "packageName": "util-linux", "product": "util-linux", "vendor": "util-linux", "versions": [{"lessThan": "2.41.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "util-linux", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.40.2-15.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"], "defaultStatus": "affected", "packageName": "util-linux", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.32.1-48.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"], "defaultStatus": "affected", "packageName": "util-linux", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.32.1-48.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "util-linux", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.37.4-21.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "util-linux", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.37.4-21.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "defaultStatus": "affected", "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791459707", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "defaultStatus": "affected", "packageName": "cert-manager/jetstack-cert-manager-rhel9", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791459711", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "defaultStatus": "affected", "packageName": "cert-manager/cert-manager-istio-csr-rhel9", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791459759", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "defaultStatus": "affected", "packageName": "cert-manager/cert-manager-operator-rhel9", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1789029076", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.18::el9"], "defaultStatus": "affected", "packageName": "cert-manager/cert-manager-operator-bundle", "product": "Cert Manager support for Red Hat OpenShift release 1.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791966259", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ceph_storage:7::el9"], "defaultStatus": "affected", "packageName": "rhceph/rhceph-7-rhel9", "product": "Red Hat Ceph Storage 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1770632724", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ceph_storage:8::el9"], "defaultStatus": "affected", "packageName": "rhceph/rhceph-8-rhel9", "product": "Red Hat Ceph Storage 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1770630907", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ceph_storage:9::el10"], "defaultStatus": "affected", "packageName": "rhceph/rhceph-9-rhel9", "product": "Red Hat Ceph Storage 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1771816028", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "util-linux-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.42-7.1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "defaultStatus": "affected", "packageName": "insights-proxy/insights-proxy-container-rhel9", "product": "Red Hat Insights proxy 1.5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1770740405", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhui:5::el9"], "defaultStatus": "affected", "packageName": "rhui5/installer-rhel9", "product": "Red Hat Update Infrastructure 5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1770646925", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhui:5::el9"], "defaultStatus": "affected", "packageName": "rhui5/cds-rhel9", "product": "Red Hat Update Infrastructure 5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1773670073", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhui:5::el9"], "defaultStatus": "affected", "packageName": "rhui5/haproxy-rhel9", "product": "Red Hat Update Infrastructure 5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1773672059", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhui:5::el9"], "defaultStatus": "affected", "packageName": "rhui5/rhua-rhel9", "product": "Red Hat Update Infrastructure 5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1773670137", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "affected", "packageName": "util-linux-ng", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "util-linux", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-8", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."}, {"lang": "es", "value": "Se encontr\u00f3 un defecto en util-linux. Esta vulnerabilidad permite una sobrelectura de b\u00fafer de mont\u00edculo al procesar nombres de usuario de 256?bytes, espec\u00edficamente dentro de la funci\u00f3n 'setpwnam()', afectando a las utilidades login?utils con SUID (Set User ID) que escriben en la base de datos de contrase\u00f1as."}], "id": "CVE-2025-14104", "lastModified": "2026-11-05T15:17:10.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14104", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T20:03:09.994553Z", "version": "2.0.3"}}]}, "published": "2025-12-05T17:16:03.117", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:1696"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:1852"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:1913"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:2485"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:2563"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:2737"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:2800"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:3406"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:4943"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:7180"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:82347"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:82354"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:82372"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:82857"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2025-14104"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419369"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames", "id": "2419369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419369"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2025-14104", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "util-linux", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "util-linux-ng", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "util-linux", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "util-linux", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "util-linux", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-12-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-14104\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14104"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-20T16:14:14.765465+00:00", "value": {"mitigation_remediation": ["Apply the Red\u202fHat errata updates RHSA\u20112026:1696, RHSA\u20112026:1852, RHSA\u20112026:1913, RHSA\u20112026:2485, RHSA\u20112026:2563, RHSA\u20112026:2737, RHSA\u20112026:2800, RHSA\u20112026:3406, RHSA\u20112026:4943, or RHSA\u20112026:7180 depending on your distribution version.", "Limit username length to 255 bytes and consider removing setuid flags from login\u2011utilities when not required.", "Assess any custom or third\u2011party software that invokes setpwnam() for similar vulnerabilities and apply appropriate updates or mitigation."], "summary": {"action": "Patch", "impact": "Information Disclosure via Buffer Overread"}, "threat_synthesis": {"affected_systems": "Affected systems include Red\u202fHat\u202fCeph\u202fStorage versions\u202f7,\u202f8,\u202f9 and Red\u202fHat\u202fEnterprise\u202fLinux\u202f6 through\u202f10, including RHEL\u202f6,\u202f7,\u202f8,\u202f9 and the\u202f10.1\u202fbase OS, as well as Red\u202fHat\u202fHardened Images, Red\u202fHat\u202fInsights\u202fProxy\u202f1.5, Red\u202fHat\u202fOpenShift\u202fContainer\u202fPlatform\u202f4, Red\u202fHat\u202fUpdate\u202fInfrastructure\u202f5, and the util\u2011linux package itself. Any deployment using these products and relying on the login\u2011utils with setuid privileges is at risk.", "description_and_impact": "The vulnerability arises when util-linux processes a username that is 256 bytes long in the setpwnam() function, causing a heap buffer overread in the SUID login\u2011utils utilities that write to the password database. This overread can expose adjacent memory contents, potentially leaking sensitive information or corrupting the password database. The weakness corresponds to CWE\u2011125, indicating a lack of bounds checking.", "risk_and_exploitability": "The CVSS score of\u202f6.1 indicates a moderate impact. EPSS is below\u202f1\u202f%, showing a very low probability of exploitation, and the vulnerability is not currently listed in CISA\u2019s KEV. Likely attack requires local execution of the affected SUID utilities, making it a local privilege escalation scenario. Nevertheless, because the overread can leak data, administrators should treat it as a risk to confidentiality and integrity and prioritize applying the Red\u202fHat patches."}}}}, "created": "2026-04-20T16:15:11.022255+00:00", "updated": "2026-04-20T16:15:11.022264+00:00", "vendors": []}