CVE-2025-14104

Published: Dec 5, 2025

Modified: Apr 19, 2026

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Vendor	Product	Versions
util-linux	util-linux	affected `0 - < 2.41.3`
Red Hat	Red Hat Enterprise Linux 10	unaffected `0:2.40.2-15.el10_1 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:2.32.1-48.el8_10 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:2.32.1-48.el8_10 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:2.37.4-21.el9_7 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:2.37.4-21.el9_7 - < *`
Red Hat	Red Hat Ceph Storage 7	unaffected `sha256:485411749726179fe5cd880e2cf308261b35150e4b356ddb7100f52e02b2e353 - < *`
Red Hat	Red Hat Ceph Storage 8	unaffected `sha256:2325f237ab329cb3f1d3db4da40ed19f68d6daa2a5902c71be3f0d3cfcadd503 - < *`
Red Hat	Red Hat Ceph Storage 9	unaffected `sha256:53a72419a7e4f4b332b9c6759ff1c389f226e26599236bc770d367c68bba911a - < *`
Red Hat	Red Hat Hardened Images	unaffected `2.42-7.1.hum1 - < *`
Red Hat	Red Hat Insights proxy 1.5	unaffected `sha256:975a1e501a8520df83f3f4114e72a71384ff1866ec99c7a45fffbf8c76ef5cbc - < *`
Red Hat	Red Hat Update Infrastructure 5	unaffected `sha256:48cf7cf48dfadb17f9357bf1894a5d0393551a893faa8b0ea0e11fe1ffed497f - < *`
Red Hat	Red Hat Update Infrastructure 5	unaffected `sha256:200c27e9b396276bd505c6b41127ac5eb1d94d620172cb818ae733f2a21ac524 - < *`
Red Hat	Red Hat Update Infrastructure 5	unaffected `sha256:d98fd3fe5f5f9acd0efae7db19b61b864be1eb2fbe2586a1b6be2429fa2cc7a3 - < *`
Red Hat	Red Hat Update Infrastructure 5	unaffected `sha256:5f1fbf66fb349a7baf066a1216d39989c3b89f18ec5108b96d9643baf4856778 - < *`
Red Hat	Red Hat Enterprise Linux 6	All versions
Red Hat	Red Hat Enterprise Linux 7	All versions
Red Hat	Red Hat OpenShift Container Platform 4	All versions