Skip to main content

GLib CVE-2026-58013

| EUVDEUVD-2026-40315 HIGH
Buffer Over-read (CWE-126)
2026-06-30 secalert@redhat.com GHSA-4x46-h598-64qr
Buffer Overflow Denial Of Service Information Disclosure Red Hat Enterprise Linux Glib Gnome
8.2
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach app using multi-byte line terminator
  2. Delivery
    Send crafted input stream
  3. Exploit
    Trigger memcmp over-read past GString
  4. Execution
    Read adjacent heap or cross page boundary
  5. Impact
    Leak 7 bytes or crash process

Vulnerability Assessment

Weakness
CWE
CWE-126
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
Exploitation Conditions

Exploitation requires the target application to have called g_io_channel_set_line_term() with a custom line terminator whose length is greater than one byte on a GIOChannel that then processes attacker-influenced data via g_io_channel_read_line/g_io_channel_read_line_backend() - this multi-byte terminator is NOT GLib's default and is the concrete gating precondition. The denial-of-service outcome additionally depends on memory layout: the over-read must cross into an unmapped page to fault, so success is probabilistic and heap/page dependent rather than guaranteed. Limiting factors: applications using the default newline terminator are not affected; the confidentiality impact is capped at roughly 7 bytes; and although CVSS marks PR:N/UI:N, real-world reachability hinges entirely on whether a deployed application uses this uncommon configuration on untrusted input.
Impact

Signals are mixed and warrant scrutiny. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L/I:N/A:H, base 8.2) implies trivial remote unauthenticated exploitation, but the description makes clear a hard precondition - the consuming application must set a custom line terminator longer than one byte, which is not the GLib default - so a network-reachable, default-configuration attack is unlikely and AC:L arguably understates the real complexity. Corroborating lower-risk indicators: EPSS is only 0.27% (19th percentile), CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, and the vulnerability is not on the CISA KEV list. The realistic worst case is a denial of service (process crash) in software that both links GLib and deliberately uses multi-byte GIOChannel line terminators on attacker-influenced input; the 7-byte information disclosure is minor. Net: this is a legitimate memory-safety bug worth patching in the normal cycle, but the 8.2 rating overstates day-to-day risk - its exploitability is gated by an uncommon application configuration rather than being broadly network-exploitable.
Exploit ScenarioDerived

An attacker who can supply input to an application that links a pre-2.88.1 GLib and has configured a multi-byte GIOChannel line terminator sends a crafted stream whose buffered contents are positioned so the terminator comparison reads past the GString allocation. In the best case for the attacker this returns up to 7 bytes of adjacent heap memory in the parsed output; if the over-read lands on an unmapped page, the process crashes, causing denial of service. No public proof-of-concept has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 02, 2026

Buffer over-read in GLib's giochannel line-reading code (g_io_channel_read_line_backend) affects the GNOME GLib library prior to version 2.88.1, where an application that configures a multi-byte custom line terminator triggers memcmp to read past the end of the internal GString buffer. Depending on memory layout, this leaks up to 7 bytes of adjacent heap memory (minor information disclosure) or crashes the process when the over-read crosses an unmapped page boundary (denial of service). There is no public exploit identified at time of analysis, EPSS is low (0.27%), and CISA SSVC rates exploitation as none.

Earlier versions of this analysis (2)
v2 Jul 02, 2026 - 19:44 cvss changed CVSS 8.2

Out-of-bounds buffer over-read in GLib's g_io_channel_read_line_backend() (giochannel.c) affects GNOME GLib before 2.88.1 and the GLib shipped across Red Hat Enterprise Linux 6 through 10. When an application configures a custom line terminator longer than one byte, memcmp reads past the end of the internal GString buffer, leaking up to 7 bytes of adjacent heap memory or crashing the process if the over-read crosses a page boundary. There is no public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC rates exploitation as none, so this is a code-path-dependent hardening fix rather than an actively exploited threat.

v1 Jun 30, 2026 - 13:36 CVSS 6.5

Buffer over-read in GLib's g_io_channel_read_line_backend() function exposes up to 7 bytes of adjacent heap memory or crashes the process when a multi-byte custom line terminator causes memcmp to read past the bounds of a GString buffer. Applications that configure GLib I/O channels with custom line terminators longer than one byte and expose those channels to attacker-controlled input are affected across Linux desktop and server software built on GNOME's core utility library. No public exploit code exists at time of analysis, and the issue has not been confirmed in CISA KEV; the 6.5 CVSS score likely overstates real-world risk given the non-default configuration prerequisite.

RemediationAI

Upgrade GLib to version 2.88.1 or later, which contains the upstream fix (patch available per vendor advisory; EUVD lists 2.88.1 as the fixed baseline). On Red Hat Enterprise Linux 6/7/8/9/10, apply the GLib package update tracked in the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58013 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2492248; upstream details are in https://gitlab.gnome.org/GNOME/glib/-/issues/3925. Where immediate patching is not possible, the practical compensating control is application-level: avoid configuring multi-byte custom line terminators via g_io_channel_set_line_term() on GIOChannels that read untrusted or network-sourced data, and where feasible revert affected code paths to the default single-byte newline handling - the trade-off is that applications specifically relying on a multi-character delimiter would need alternative parsing. Because the impact is limited to a 7-byte read or a crash, restricting exposure of any service that both uses this feature and processes attacker-controlled input (network segmentation, input size/rate limiting) is a reasonable stopgap until the library is updated.

Affected VersionsENISA

glib 0 <2.88.1

Affected Packages

euvd glib fix: 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib is the low-level C utility library underpinning GNOME and a vast range of Linux desktop and server software, providing core data structures and I/O primitives. The defect is CWE-126 (Buffer Over-read) in the GIOChannel subsystem: g_io_channel_read_line_backend() in giochannel.c uses memcmp to compare buffered input against a caller-supplied line terminator string (set via g_io_channel_set_line_term). When that terminator is longer than one byte, the comparison logic can advance the comparison window past the bytes actually present in the backing GString, causing memcmp to dereference memory beyond the allocation. Per the EUVD/CPE data the affected component is gnome:glib in all versions below 2.88.1, and Red Hat maps the exposure across Red Hat Enterprise Linux 6, 7, 8, 9, and 10 where GLib is a base dependency.

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY MEDIUM
NVD 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI 6.5 MEDIUM

Attacker-reachable data yields AV:N and PR:N/UI:N, but the required non-default multi-byte line terminator plus page-boundary dependency justify AC:H; impact is 7-byte read (C:L) and crash (A:H), no integrity loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat 6.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

3
Severity Changed
Jul 02, 2026 - 19:37 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:37 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.

Executive ViewAI

Why It Matters

GLib versions prior to 2.88.1 contain a buffer over-read vulnerability in I/O channel line-reading code that affects GNOME-based applications across the organization. The vulnerability can result in disclosure of heap memory contents or process crashes, potentially disrupting service availability for systems relying on affected GLib libraries.

Business Impact: High
Compensating Controls

Apply vendor patch: GLib 2.88.1

Threat Intelligence Overview

EPSS Score
0.3%
Top 81% exploitable
Prevalence
Ubiquitous
core GNOME/Linux utility library present in nearly all Linux distributions
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2022-2124 HIGH POC
7.8
CVE-2022-2175 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58013 ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/374842 REF https://access.redhat.com/errata/RHSA-2026:49512 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-58013 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492248 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3925

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy