CVE-2025-14104: util-linux Out-of-bounds Read
CVSS: 6.1v3.1MediumDeferred
AliasesALPINE-CVE-2025-14104SUSE-SU-2026:0116-1SUSE-SU-2026:0117-1SUSE-SU-2026:0230-1SUSE-SU-2026:0366-1SUSE-SU-2026:0510-1SUSE-SU-2026:20346-1SUSE-SU-2026:20365-1RHSA-2026:1696RHSA-2026:1852RHSA-2026:1913UBUNTU-CVE-2025-14104DEBIAN-CVE-2025-14104SUSE-SU-2026:0115-1openSUSE-SU-2026:10072-1
Published 05-12-2025Last modified 14-10-2026
Vulnerability summary
CVE-2025-14104 is a medium (CVSS 6.1) Out-of-bounds Read vulnerability in util-linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.3% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.20%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 05-12-2025PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- NVDNIST6.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
+0.01 pp
From 0.19% on 19-09-2026
19-09-202619-10-2026
EPSS score0.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat26 products
- libblkid< 0:2.40.2-15.el10_1 | < 0:2.32.1-48.el8_10 | < 0:2.37.4-21.el9_7
- libblkid-debuginfo< 0:2.40.2-15.el10_1 | < 0:2.32.1-48.el8_10 | < 0:2.37.4-21.el9_7
- libblkid-devel< 0:2.40.2-15.el10_1 | < 0:2.32.1-48.el8_10 | < 0:2.37.4-21.el9_7
- libfdisk< 0:2.40.2-15.el10_1 | < 0:2.32.1-48.el8_10 | < 0:2.37.4-21.el9_7
- libfdisk-debuginfo< 0:2.40.2-15.el10_1 | < 0:2.32.1-48.el8_10 | < 0:2.37.4-21.el9_7
Suse18 products
- python-libmount&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 2.33.2-4.48.1
- util-linux-systemd&distro=SUSE Linux Enterprise Micro 5.2< 2.36.2-150300.4.50.1
- util-linux-systemd&distro=SUSE Linux Enterprise Micro 5.3< 2.37.2-150400.8.38.1
- util-linux-systemd&distro=SUSE Linux Enterprise Micro 5.4< 2.37.2-150400.8.38.1
- util-linux-systemd&distro=SUSE Linux Enterprise Micro 5.5< 2.37.4-150500.9.20.1
Opensuse5 products
- python-libmount&distro=openSUSE Leap 15.6< 2.39.3-150600.4.15.1
- python3-libmount&distro=openSUSE Leap 15.6< 2.37.4-150500.9.20.1
- util-linux-systemd&distro=openSUSE Leap 15.6< 2.39.3-150600.4.15.1
- util-linux&distro=openSUSE Leap 15.6< 2.39.3-150600.4.15.1 | < 2.37.4-150500.9.20.1
- util-linux&distro=openSUSE Tumbleweed< 2.41.3-1.1
Alpine1 product
- util-linux< 2.41.6-r0 | < 2.41.4-r0
Debian1 product
- util-linuxAll versions (No fix recorded) | < 2.41.3-1
Ubuntu1 product
- util-linuxAll versions (No fix recorded)
Util-linux1 product
- util-linux< 2.41.3
7 vendors · 53 products
