Skip to main content

GLib CVE-2026-58016

| EUVDEUVD-2026-40319 CRITICAL
Integer Underflow (CWE-191)
2026-06-30 secalert@redhat.com GHSA-8rpw-4xx7-27w7
9.1
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
HIGH
qualitative
NVD
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
8.2 HIGH

Out-of-bounds read causes a crash (A:H) with at most limited memory exposure (C:L, not H); reachable without auth or interaction where an app parses untrusted introspection XML, hence AV:N/AC:L/PR:N/UI:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 01, 2026 - 17:58 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 01, 2026 - 17:58 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 01, 2026 - 17:52 vuln.today
cvss_changed
Severity Changed
Jul 01, 2026 - 17:52 NVD
HIGH CRITICAL
CVSS changed
Jul 01, 2026 - 17:52 NVD
7.5 (HIGH) 9.1 (CRITICAL)
Patch available
Jun 30, 2026 - 16:01 EUVD
Analysis Generated
Jun 30, 2026 - 13:32 vuln.today

DescriptionNVD

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a <node> element nested within other elements like <method>, <signal>, <property> or <arg>. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

AnalysisAI

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-Bus introspection XML that nests a <node> element inside <method>, <signal>, <property>, or <arg>. This state-confusion bug triggers an unsigned integer underflow/overflow (CWE-191) and a subsequent out-of-bounds read, crashing any application or service that parses attacker-influenced introspection data. No public exploit identified at time of analysis, EPSS is low (0.34%), and CISA SSVC rates exploitation as none with only partial technical impact.

Technical ContextAI

GLib is the foundational C utility library underpinning the GNOME stack and countless Linux applications; its GIO subsystem provides a full D-Bus implementation. The affected routine, g_dbus_node_info_new_for_xml() in gio/gdbusintrospection.c, converts a D-Bus introspection XML document into GDBusNodeInfo structures. D-Bus introspection XML has a defined nesting grammar where <node> is a top-level/container element; when a <node> is illegally nested inside leaf elements such as <method>, <signal>, <property>, or <arg>, the parser's state tracking becomes confused. Per CWE-191 (Integer Underflow/Overflow), an unsigned counter or index wraps around, producing a bogus large value that drives an out-of-bounds read of adjacent memory. CPE data scopes this to cpe:2.3:a:gnome:glib and the Red Hat Enterprise Linux 6 through 10 operating-system packages that ship GLib.

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 or later, which corrects the state-confusion handling of nested <node> elements. On enterprise distributions, apply the corresponding OS package update (track the Red Hat erratum via https://access.redhat.com/security/cve/CVE-2026-58016) rather than building from source. Where immediate patching is not possible, the practical compensating control is to avoid passing untrusted or externally supplied introspection XML to g_dbus_node_info_new_for_xml() - restrict introspection parsing to trusted D-Bus peers, validate/reject XML that nests <node> inside <method>/<signal>/<property>/<arg> before handing it to GLib, and limit exposure of any service that accepts remote introspection data; the trade-off is that such input filtering must be implemented at the application layer and may break legitimate but unusual introspection documents. Confirm the exact fixed package build in the upstream GNOME issue (https://gitlab.gnome.org/GNOME/glib/-/issues/3932) and Bugzilla 2492257.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

Share

CVE-2026-58016 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy