CVE-2025-0395: the gnu c library glibc Incorrect Calculation of Buffer Size
Vulnerability summary
CVE-2025-0395 is a medium (CVSS 6.2) Incorrect Calculation of Buffer Size vulnerability in the gnu c library glibc. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 22-01-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · Red hatEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
0.00 pp
From 0.36% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat192 products
- compat-libpthread-nonshared< 0:2.28-251.el8_10.16
- glibc< 0:2.28-251.el8_10.16 | < 0:2.34-60.el9_2.17 | < 0:2.34-28.el9_0.8 | < 0:2.34-100.el9_4.10 | < 0:2.34-125.el9_5.8
- glibc-all-langpacks< 0:2.28-251.el8_10.16 | < 0:2.34-60.el9_2.17 | < 0:2.34-28.el9_0.8 | < 0:2.34-100.el9_4.10 | < 0:2.34-125.el9_5.8
- glibc-all-langpacks-debuginfo< 0:2.28-251.el8_10.16
- glibc-benchtests< 0:2.28-251.el8_10.16 | < 0:2.34-60.el9_2.17 | < 0:2.34-100.el9_4.10 | < 0:2.34-125.el9_5.8
Opensuse2 products
- glibc&distro=openSUSE Leap 15.6< 2.38-150600.14.23.1
- glibc&distro=openSUSE Tumbleweed< 2.41-1.1
Ubuntu2 products
- eglibc< 2.19-0ubuntu6.15+esm4
- glibc< 2.27-3ubuntu1.6+esm4 | < 2.31-0ubuntu9.17 | < 2.35-0ubuntu3.9 | < 2.39-0ubuntu8.4 | < 2.23-0ubuntu11.3+esm8
Chainguard1 product
- glibc< 2.40-r6
Debian1 product
- glibc< 2.36-9+deb12u10 | < 2.40-6 | < 2.31-13+deb11u12
Mageia1 product
- glibc< 2.36-55.mga9
Wolfi1 product
- glibc< 2.40-r6
7 vendors · 200 products · Showing 200 of 261. Use Open JSON for the complete list.