BlackTreeCVE IntelligenceUnknown · Unknown
High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Debian findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Distribution release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Debian trixietrixie · source | glib2.0 | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Debian bookwormbookworm · source | glib2.0 | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Debian forkyforky · source | glib2.0 | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Debian sidsid · source | glib2.0 | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Fix not verifiedA flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.
A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.
Untrusted data can cross into a code-evaluation path and be interpreted as executable instructions.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.
Untrusted data can cross into a code-evaluation path and be interpreted as executable instructions.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
CISA Vulnrichment records proof-of-concept exploitation in its SSVC data. BlackTree has not independently executed or validated exploit material.
CWE-94: Improper Control of Generation of Code ('Code Injection'). The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 28 Jul 2025 · Last source change 30 Jun 2026, 10:40 UTC · CWE-94 · Improper Control of Generation of Code ('Code Injection')
Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.