EUVD-2026-45266
GHSA-cp7g-r78m-cc2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlant crafted magic file in $XDG_DATA_HOME/mime/magic
-
DeliveryVictim app calls g_content_type_guess()
-
ExploitByte-swap in _xdg_mime_magic_parse_magic_line()
-
Execution2-byte out-of-bounds heap write
-
ImpactApplication crash or memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a little-endian CPU (e.g. x86/x86_64 or little-endian ARM - the common case, so not a strong limiter), local write access to a user-writable XDG data location so the attacker can place a crafted MIME magic file at $XDG_DATA_HOME/mime/magic, and a victim application that subsequently performs MIME type detection (e.g. via g_content_type_guess()) which loads and parses that file. Limiting factors: it does not fire on big-endian systems, it needs local file-write access rather than any network vector (AV:L), and it depends on user interaction (UI:R) in that some application must actually parse the malicious database; it yields no confidentiality impact and, as scored, no privilege gain beyond the parsing process's own context. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, 7.1) correctly frames this as a locally-triggered availability/integrity issue rather than a remote code execution primitive: exploitation requires the ability to write a file into a local user-writable XDG data path and for an application to then parse it (UI:R), and it only fires on little-endian systems. There is no confidentiality impact (C:N). No EPSS score, POC, or KEV entry was provided, and no public exploit is identified, so real-world exploitation pressure is currently low despite the Important-severity rating. The main residual risk is scenario-dependent: if a higher-privileged service or a different user is induced to parse an attacker-planted magic file, the 2-byte OOB write could be leveraged beyond a self-inflicted crash - but as scored (S:U, local, no privilege gain over one's own session) this is primarily a robustness/DoS and potential memory-corruption bug rather than a mass-exploitable RCE. Worth verifying with the vendor: PR:N is assigned even though the attacker must control a file in a user-writable directory, which in practice presumes local account access. |
| Exploit ScenarioDerived | On a shared little-endian Linux host, a local user writes a crafted magic database to $XDG_DATA_HOME/mime/magic, then opens a file manager or launches an application that calls g_content_type_guess(); parsing the malicious byte-swap entry triggers a 2-byte out-of-bounds heap write, crashing the process or corrupting adjacent heap memory. If a higher-privileged process is coaxed into parsing the attacker's magic file, the same corruption could be escalated. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patched version was identified in the provided data; the upstream fix is tracked as a freedesktop xdgmime work item (https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41) and a released patched version is not independently confirmed, so monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-16118) and apply the xdgmime/GLib update for your RHEL 7/8/9/10 release as soon as it ships. As compensating controls until a patch lands, restrict who can write to per-user XDG data locations and audit for unexpected $XDG_DATA_HOME/mime/magic files, since planting one is the precondition; on multi-user or service hosts, ensure daemons that perform MIME detection do not read magic databases from untrusted user home directories - for example run such services with a sanitized XDG_DATA_HOME/XDG_DATA_DIRS pointing only to trusted system paths, accepting that this disables user-customized MIME associations. There is no network-facing surface to firewall off; the trade-off of these controls is reduced per-user MIME customization.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
xdgmime is the reference implementation of the freedesktop.org Shared MIME-info specification and is vendored into GLib/GIO, so it underpins content-type detection across the Linux desktop stack (file managers, GTK applications, thumbnailers, and anything calling g_content_type_guess()). Compiled MIME magic databases (the $XDG_DATA_HOME/mime/magic file) are parsed at runtime to match file signatures. The bug is a textbook CWE-122 heap-based buffer overflow: while byte-swapping magic values on little-endian hardware, _xdg_mime_magic_parse_magic_line() performs incorrect pointer arithmetic on the write side, so the swapped 2-byte value is stored past the end of the allocated buffer. Because XDG data directories under the user's home are writable and take precedence in the MIME lookup order, a user can supply a malicious magic database that any subsequently launched MIME-parsing process will load.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Local attacker-controlled magic file (AV:L) parsed only when an app performs MIME detection (UI:R); OOB write corrupts memory (I:H/A:H) with no data disclosure (C:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
Executive ViewAI
The xdgmime library bundled in GLib and widely distributed across Linux distributions enables local attackers to crash applications and corrupt memory through maliciously crafted MIME configuration files. This impacts organizations operating multi-user systems and managed Linux desktops where unprivileged users can place files in shared directories. With no vendor patch currently available and pervasive dependency on affected code, immediate interim controls are essential to protect production systems.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce restrictive permissions (0700 minimum) on ~/.local/share/ and XDG data directories to prevent file creation by local users; deploy file integrity monitoring on XDG directories using system tools (aide, tripwire, or osquery); disable MIME detection functionality in applications where non-essential; restrict local system access to authorized users only; consider containerization of vulnerable high-value applications with restricted filesystem access; monitor vendor channels for patch availability and coordinate testing procedures before production deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB