CVE-2025-14104mediumCWE-125

CVE-2025-14104: medium-severity vulnerability in util-linux

Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

Published · Updated

Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat OpenShift Container Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.2%
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Affected products
Red Hat · Cert Manager support for Red Hat OpenShift release 1.18Red Hat · Red Hat Ceph Storage 7Red Hat · Red Hat Ceph Storage 8Red Hat · Red Hat Ceph Storage 9Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Hardened ImagesRed Hat · Red Hat Insights proxy 1.5Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat Update Infrastructure 5util-linux · util-linux
Related CVEs — util-linux

In the same product, most dangerous first.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2025-32988MEDIUMGnutls: vulnerability in gnutls othername san exportEPSS 1.5%CVE-2025-32989MEDIUMGnutls: vulnerability in gnutls sct extension parsingEPSS 1.5%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.3%