Skip to main content

GLib CVE-2026-58010

| EUVDEUVD-2026-40312 HIGH
Buffer Over-read (CWE-126)
2026-06-30 secalert@redhat.com GHSA-m7rp-473c-296x
Denial Of Service Buffer Overflow Information Disclosure Glib Enterprise Linux
8.2
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
8.2 HIGH

Untrusted GVariant/D-Bus input is remotely reachable without auth or interaction (AV:N/AC:L/PR:N/UI:N); one-byte over-read gives C:L, no integrity impact, and a page-boundary crash yields A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 02, 2026 - 19:30 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 02, 2026 - 19:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 02, 2026 - 19:22 vuln.today
cvss_changed
Severity Changed
Jul 02, 2026 - 19:22 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:22 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD
Analysis Generated
Jun 30, 2026 - 13:35 vuln.today

DescriptionNVD

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

AnalysisAI

Out-of-bounds read in GNOME GLib's GVariant serialiser allows remote attackers to leak a single byte of adjacent memory and to crash applications that deserialise untrusted GVariant data. The flaw sits in gvs_tuple_is_normal() in glib/gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; when that byte falls across a page boundary the process faults, producing a denial of service. No public exploit identified at time of analysis, and EPSS is low (0.26%), but GLib's near-universal presence on Linux systems makes the exposure broad.

Technical ContextAI

GLib is the foundational C utility library underpinning GTK, GNOME, systemd-adjacent tooling and countless Linux applications and daemons. The affected code is GVariant, GLib's type-safe serialization format used heavily for D-Bus message marshalling, GSettings storage and IPC. The bug is a classic CWE-126 buffer over-read: gvs_tuple_is_normal() validates alignment padding while walking a serialized tuple, but its bounds comparison uses '>' where it should use '>=', so a maximally-sized offset is treated as in-bounds and the routine dereferences one byte beyond the allocation. Per NVD CPE data the affected package is cpe:2.3:a:gnome:glib (including 2.88.0), consumed across Red Hat Enterprise Linux 6 through 10 (cpe:2.3:o:redhat:enterprise_linux).

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 (or 2.86.5 on the 2.86 maintenance branch) or later, per the ENISA EUVD fixed-version data; on Red Hat Enterprise Linux apply the distribution glib2 update tracked at https://access.redhat.com/security/cve/CVE-2026-58010 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2492243, with upstream detail at https://gitlab.gnome.org/GNOME/glib/-/issues/3915. Because GLib is a shared system library, patch the OS package and restart or re-link dependent long-running services (D-Bus consumers, desktop session, daemons) so they load the fixed library. No supported source-level workaround exists; as a compensating control, restrict exposure of services that deserialise untrusted GVariant/D-Bus data to remote or low-privilege callers - for example limit D-Bus policy to trusted senders and avoid feeding externally-sourced GVariant blobs to unpatched processes - accepting that this narrows functionality for affected IPC interfaces.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2026-64905 HIGH
7.8
CVE-2023-0817 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

Share

CVE-2026-58010 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy