PT-2025-49263 · Unknown+2 · Util-Linux+2

Published 2025-01-01 · Updated 2026-05-27 · CVE-2025-14104

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions util-linux (affected versions not specified)

Description A flaw exists in util-linux that allows a heap buffer overread when processing 256-byte usernames. This issue is specifically present within the setpwnam() function and impacts SUID (Set User ID) login-utils utilities that write to the password database. The vulnerability occurs when the setpwnam() function processes usernames.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

LPE

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2026:1696

ALSA-2026:1852

ALSA-2026:1913

AZL-72305

AZL-72307

BDU:2026-02747

CVE-2025-14104

ECHO-2993-D712-59CE

OPENSUSE-SU-2026:10072-1

OPENSUSE-SU-2026:20495-1

RHSA-2026:1696

RHSA-2026:1852

RHSA-2026:1913

RHSA-2026:7180

SUSE-SU-2026:0115-1

SUSE-SU-2026:0116-1

SUSE-SU-2026:0117-1

SUSE-SU-2026:0230-1

SUSE-SU-2026:0366-1

SUSE-SU-2026:0510-1

SUSE-SU-2026:20346-1

SUSE-SU-2026:20365-1

SUSE-SU-2026:21016-1

SUSE-SU-2026:21158-1

Affected Products

Debian

Rocky Linux

Util-Linux

References · 84

• https://security-tracker.debian.org/tracker/CVE-2025-14104 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14104 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02747 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0510-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:1696 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:1913 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14104 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20495-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14104 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2025-14104 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-72307 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14104 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20346-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-14104 · Vendor Advisory