EUVD-2026-45266
GHSA-cp7g-r78m-cc2g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Local attacker-controlled magic file (AV:L) parsed only when an app performs MIME detection (UI:R); OOB write corrupts memory (I:H/A:H) with no data disclosure (C:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
AnalysisAI
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
xdgmime is the reference implementation of the freedesktop.org Shared MIME-info specification and is vendored into GLib/GIO, so it underpins content-type detection across the Linux desktop stack (file managers, GTK applications, thumbnailers, and anything calling g_content_type_guess()). Compiled MIME magic databases (the $XDG_DATA_HOME/mime/magic file) are parsed at runtime to match file signatures. The bug is a textbook CWE-122 heap-based buffer overflow: while byte-swapping magic values on little-endian hardware, _xdg_mime_magic_parse_magic_line() performs incorrect pointer arithmetic on the write side, so the swapped 2-byte value is stored past the end of the allocated buffer. Because XDG data directories under the user's home are writable and take precedence in the MIME lookup order, a user can supply a malicious magic database that any subsequently launched MIME-parsing process will load.
RemediationAI
No vendor-released patched version was identified in the provided data; the upstream fix is tracked as a freedesktop xdgmime work item (https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41) and a released patched version is not independently confirmed, so monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-16118) and apply the xdgmime/GLib update for your RHEL 7/8/9/10 release as soon as it ships. As compensating controls until a patch lands, restrict who can write to per-user XDG data locations and audit for unexpected $XDG_DATA_HOME/mime/magic files, since planting one is the precondition; on multi-user or service hosts, ensure daemons that perform MIME detection do not read magic databases from untrusted user home directories - for example run such services with a sanitized XDG_DATA_HOME/XDG_DATA_DIRS pointing only to trusted system paths, accepting that this disables user-customized MIME associations. There is no network-facing surface to firewall off; the trade-off of these controls is reduced per-user MIME customization.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today