Skip to main content

GLib EUVDEUVD-2026-40312

| CVE-2026-58010 HIGH
Buffer Over-read (CWE-126)
2026-06-30 secalert@redhat.com GHSA-m7rp-473c-296x
Buffer Overflow Denial Of Service Information Disclosure Enterprise Linux Glib
8.2
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
8.2 HIGH

Untrusted GVariant/D-Bus input is remotely reachable without auth or interaction (AV:N/AC:L/PR:N/UI:N); one-byte over-read gives C:L, no integrity impact, and a page-boundary crash yields A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (redhat).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 02, 2026 - 19:30 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 02, 2026 - 19:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 02, 2026 - 19:22 vuln.today
cvss_changed
Severity Changed
Jul 02, 2026 - 19:22 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:22 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD
Analysis Generated
Jun 30, 2026 - 13:35 vuln.today

DescriptionNVD

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

AnalysisAI

Out-of-bounds read in GNOME GLib's GVariant serialiser allows remote attackers to leak a single byte of adjacent memory and to crash applications that deserialise untrusted GVariant data. The flaw sits in gvs_tuple_is_normal() in glib/gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; when that byte falls across a page boundary the process faults, producing a denial of service. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach GVariant-parsing service (e.g. D-Bus)
Delivery
Send crafted tuple with malformed padding
Exploit
Trigger off-by-one over-read in gvs_tuple_is_normal
Execution
Leak adjacent byte or fault on page boundary
Impact
Information disclosure or process crash (DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a vulnerable GLib version (below 2.88.1 / 2.86.5) deserialises attacker-controlled GVariant data - most realistically via a D-Bus service, GSettings input, or any application that parses externally-sourced GVariant tuples through gvs_tuple_is_normal(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are moderate and partially conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted GVariant-serialised message (for example over a D-Bus interface or another IPC path that deserialises untrusted GVariant data) whose tuple padding is sized to trigger the off-by-one read in gvs_tuple_is_normal(). The over-read leaks one adjacent byte back to the attacker or, if the byte lies on an unmapped page, crashes the consuming process, denying service. …
Remediation Vendor-released patch: upgrade GLib to 2.88.1 (or 2.86.5 on the 2.86 maintenance branch) or later, per the ENISA EUVD fixed-version data; on Red Hat Enterprise Linux apply the distribution glib2 update tracked at https://access.redhat.com/security/cve/CVE-2026-58010 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2492243, with upstream detail at https://gitlab.gnome.org/GNOME/glib/-/issues/3915. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory GLib versions across all Linux systems and identify business-critical applications dependent on affected versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Enterprise Linux

View all
CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2025-6021 HIGH POC
7.5 Jun 12

Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
CVE-2024-0553 HIGH POC
7.5 Jan 16

A vulnerability was found in GnuTLS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth
CVE-2025-46397 HIGH POC
7.8 Apr 23

A flaw was found in xfig. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit co
CVE-2025-5914 HIGH POC
7.8 Jun 09

CVE-2025-5914 is an integer overflow vulnerability in libarchive's archive_read_format_rar_seek_data() function that lea
CVE-2025-3155 HIGH POC
7.4 Apr 03

A flaw was found in Yelp. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication

CVE-2025-2784 MEDIUM POC
6.5 Apr 03

A flaw was found in libsoup. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authenticati
CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2025-66692 HIGH POC
7.5
CVE-2026-34059 HIGH POC
7.5
CVE-2026-26282 MEDIUM POC
6.6
CVE-2025-60729 MEDIUM POC
5.3
CVE-2025-12106 CRITICAL
9.1
CVE-2025-32704 HIGH
8.4
CVE-2026-41898 HIGH
8.3
CVE-2024-49846 HIGH
8.2

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

EUVD-2026-40312 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy