Loading vulnerability…
Buffer overflow in GNU C Library assert() failure handling
CVE-2025-0395 is a buffer-overflow vulnerability affecting GNU C Library (glibc) versions 2.13 through 2.40. When an assert() check fails, the assertion-failure handling allocates insufficient space for the failure-message string and its associated size information. If the message-string size aligns with the system page size, the insufficient allocation can cause a buffer overflow, potentially disrupting the affected application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can affect application availability through a buffer overflow during assertion-failure handling. The CVSS v3.0 assessment is 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no assessed confidentiality or integrity impact. Arbitrary code execution, privilege escalation, and data disclosure are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. For affected Siemens RUGGEDCOM ROX deployments, restrict device access using appropriate access controls and follow the vendor's industrial-security configuration guidance until the update is installed. These measures do not correct the underlying allocation error.
Patch, then assume compromise.
Install vendor-provided glibc security updates for the affected operating-system release, including applicable backported fixes, and update affected container images or appliances through their supported vendor upgrade process. Google Container-Optimized OS remediation targets include builds 17800.519.1, 18244.291.40, and 18964.0.0 or later within the corresponding release branch; these are platform-specific targets, not upstream glibc version numbers. Affected Siemens RUGGEDCOM ROX products should be upgraded to V2.17.1 or later. F5 products are not affected and require no remediation.
No public exploits tracked yet. Mallory keeps watching.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.