What is the CVSS score of CVE-2026-58016?

CVE-2026-58016 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-58016?

Within 24 hours: Identify all systems and applications using GLib versions prior to 2.88.1, including production services, containerized workloads, and embedded systems. Within 7 days: Develop and test a patching strategy to upgrade GLib to 2.88.1 or later across development, staging, and production environments. Within 30 days: Complete deployment of GLib 2.88.1 infrastructure-wide and confirm D-Bus-dependent services are operational.

GLib CVE-2026-58016

EUVD-2026-40319 CRITICAL

Integer Underflow (CWE-191)

2026-06-30 secalert@redhat.com

GHSA-8rpw-4xx7-27w7

Buffer Overflow Denial Of Service Integer Overflow Red Hat Enterprise Linux Glib Gnome

9.1

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach app parsing introspection XML
Delivery

Deliver malformed XML nesting <node> in <arg>
Exploit

Trigger unsigned integer overflow in parser
Execution

Force out-of-bounds read
Impact

Crash process (denial of service)

Vulnerability Assessment

Weakness	CWE CWE-191 ASVS 5.0 V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions	Exploitation requires that the target application or service call g_dbus_node_info_new_for_xml() (or equivalent GDBusNodeInfo XML parsing) on introspection XML the attacker can control or influence, and that XML must specifically nest a <node> element inside a <method>, <signal>, <property>, or <arg> element to trigger the state confusion. The key limiting factor is reachability: D-Bus introspection is typically consumed from local/trusted peers, so remote exploitation only applies where a program parses introspection data sourced from an untrusted or network-reachable endpoint - in purely local D-Bus setups the attacker needs the ability to present malicious introspection data to a consuming client. No authentication is indicated by the CVSS vector (PR:N) and no user interaction is required (UI:N), but the impact is limited to a crash/denial of service, not code execution.
Impact	The signals conflict and warrant scrutiny. The NVD CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) is driven largely by a High confidentiality rating, but the description only substantiates an out-of-bounds READ leading to a crash (denial of service) - memory disclosure to the attacker is not demonstrated, so C:H is likely overstated and the true impact is closer to a DoS with at most limited info leakage. The AV:N (network) rating is also debatable because D-Bus is predominantly a local IPC mechanism; network exposure only exists where an application parses introspection XML received from a remote or untrusted source - verify the actual data path in your deployment. Corroborating the lower-priority read: EPSS is 0.34% (26th percentile), the vulnerability is NOT in CISA KEV, SSVC marks exploitation as none and technical impact as only partial, and no POC is referenced. SSVC does flag Automatable: yes, meaning that where the code path is reachable, triggering the crash is reliable and scriptable. Net assessment: a genuine availability bug in ubiquitous software worth patching in the normal cycle, but the headline 9.1 overstates real-world urgency - this is a high-CVSS, moderate-real-risk DoS, not an actively exploited RCE.
Exploit ScenarioDerived	An attacker supplies a crafted D-Bus introspection XML document containing a <node> element nested inside a <method> or <arg> to a target application or service that calls g_dbus_node_info_new_for_xml(). The parser's integer counter wraps, an out-of-bounds read follows, and the process crashes, denying service. Given AC:L and SSVC Automatable: yes, the malicious payload is simple to reproduce and script, though no public POC is currently referenced.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 01, 2026

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-Bus introspection XML that nests a <node> element inside <method>, <signal>, <property>, or <arg>. This state-confusion bug triggers an unsigned integer underflow/overflow (CWE-191) and a subsequent out-of-bounds read, crashing any application or service that parses attacker-influenced introspection data. No public exploit identified at time of analysis, EPSS is low (0.34%), and CISA SSVC rates exploitation as none with only partial technical impact.

Earlier versions of this analysis (2)

v2 Jul 01, 2026 - 17:58 cvss changed CVSS 9.1

Denial of service in GLib (GNOME's core C utility library) affects all versions before 2.88.1 through a state-confusion bug in g_dbus_node_info_new_for_xml() within gio/gdbusintrospection.c. When the D-Bus introspection parser encounters a <node> element illegally nested inside a <method>, <signal>, <property>, or <arg>, an unsigned integer overflow (CWE-191) drives an out-of-bounds read that crashes the consuming process. No public exploit identified at time of analysis; EPSS probability is low (0.34%, 26th percentile) and CISA SSVC rates exploitation as none, though the flaw is automatable.

v1 Jun 30, 2026 - 13:32 CVSS 7.5

Denial of service in GLib's GIO D-Bus introspection parser allows attackers supplying malformed introspection XML to crash applications that call g_dbus_node_info_new_for_xml(). A state-confusion bug triggered by a <node> element illegally nested inside <method>, <signal>, <property>, or <arg> elements causes an unsigned integer overflow and a subsequent out-of-bounds read. The flaw was reported by Red Hat, carries a CVSS 7.5 (availability-only impact), and has no public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 or later, which corrects the state-confusion handling of nested <node> elements. On enterprise distributions, apply the corresponding OS package update (track the Red Hat erratum via https://access.redhat.com/security/cve/CVE-2026-58016) rather than building from source. Where immediate patching is not possible, the practical compensating control is to avoid passing untrusted or externally supplied introspection XML to g_dbus_node_info_new_for_xml() - restrict introspection parsing to trusted D-Bus peers, validate/reject XML that nests <node> inside <method>/<signal>/<property>/<arg> before handing it to GLib, and limit exposure of any service that accepts remote introspection data; the trade-off is that such input filtering must be implemented at the application layer and may break legitimate but unusual introspection documents. Confirm the exact fixed package build in the upstream GNOME issue (https://gitlab.gnome.org/GNOME/glib/-/issues/3932) and Bugzilla 2492257.

Affected VersionsENISA

glib 0 <2.88.1

Affected Packages

euvd glib fix: 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

GLib is the foundational C utility library underpinning the GNOME stack and countless Linux applications; its GIO subsystem provides a full D-Bus implementation. The affected routine, g_dbus_node_info_new_for_xml() in gio/gdbusintrospection.c, converts a D-Bus introspection XML document into GDBusNodeInfo structures. D-Bus introspection XML has a defined nesting grammar where <node> is a top-level/container element; when a <node> is illegally nested inside leaf elements such as <method>, <signal>, <property>, or <arg>, the parser's state tracking becomes confused. Per CWE-191 (Integer Underflow/Overflow), an unsigned counter or index wraps around, producing a bogus large value that drives an out-of-bounds read of adjacent memory. CPE data scopes this to cpe:2.3:a:gnome:glib and the Red Hat Enterprise Linux 6 through 10 operating-system packages that ship GLib.

Know when Glib gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY HIGH

NVD 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI 8.2 HIGH

Out-of-bounds read causes a crash (A:H) with at most limited memory exposure (C:L, not H); reachable without auth or interaction where an app parses untrusted introspection XML, hence AV:N/AC:L/PR:N/UI:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 01, 2026 - 17:58 vuln.today

v3 - CVSS changed

Analysis Updated

Jul 01, 2026 - 17:58 vuln.today

v2 - CVSS changed

Severity Changed

Jul 01, 2026 - 17:52 NVD

HIGH CRITICAL

CVSS changed

Jul 01, 2026 - 17:52 NVD

7.5 (HIGH) 9.1 (CRITICAL)

Patch available

Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a <node> element nested within other elements like <method>, <signal>, <property> or <arg>. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

Executive ViewAI

Why It Matters

GNOME GLib versions before 2.88.1 contain a denial-of-service vulnerability in D-Bus introspection XML parsing that could crash dependent applications organization-wide, creating unplanned service availability risk across the infrastructure. Although no public exploit has been identified and exploitation likelihood is low (EPSS 0.3%), the critical CVSS score of 9.1 reflects significant impact should the vulnerability be exploited. Organizations must prioritize rapid patching to eliminate this potential service outage vector.

Business Impact: High

Compensating Controls

Vendor-released patch: GLib 2.88.1. Apply vendor patch to all affected systems.

Threat Intelligence Overview

EPSS Score

0.3%

Top 74% exploitable

Prevalence

Ubiquitous

core library across nearly all Linux/GNOME systems and RHEL 6-10

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Glib

View all

CVE-2024-52533 CRITICAL Act Now POC

9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON

CVE-2018-16428 CRITICAL Act Now POC

9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev

CVE-2025-13601 HIGH Act Now POC

7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and

CVE-2021-27219 HIGH This Week POC

7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne

CVE-2020-35457 HIGH This Week POC

7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri

CVE-2018-16429 HIGH This Week POC

7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf

CVE-2020-6750 MEDIUM This Month POC

5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v

CVE-2025-14087 CRITICAL Act Now

9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian

CVE-2021-28153 MEDIUM This Month POC

5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex

CVE-2019-12450 CRITICAL Act Now

9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM This Month POC

5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.

CVE-2026-58014 HIGH This Week

8.6 Jun 30

Denial of service (and a 1-byte out-of-bounds read) in GNOME GLib before 2.88.1 arises from an off-by-one error in g_key

Same weakness CWE-191 – Integer Underflow

View all

CVE-2014-0497 CRITICAL POC

9.8

CVE-2015-5212 MEDIUM

6.8

CVE-2017-14496 HIGH POC

7.5

CVE-2014-8768 MEDIUM POC

5.0

CVE-2017-11757 CRITICAL POC

9.8

CVE-2024-23313 CRITICAL POC

9.8

CVE-2021-3323 CRITICAL POC

9.8

CVE-2021-21811 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
Container suse/sles/16.0/toolbox:latest	Affected
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back