Skip to main content

GLib EUVDEUVD-2026-40312

| CVE-2026-58010 HIGH
Buffer Over-read (CWE-126)
2026-06-30 secalert@redhat.com GHSA-m7rp-473c-296x
Denial Of Service Buffer Overflow Information Disclosure Glib Enterprise Linux
8.2
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI
8.2 HIGH

Untrusted GVariant/D-Bus input is remotely reachable without auth or interaction (AV:N/AC:L/PR:N/UI:N); one-byte over-read gives C:L, no integrity impact, and a page-boundary crash yields A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 02, 2026 - 19:30 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 02, 2026 - 19:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 02, 2026 - 19:22 vuln.today
cvss_changed
Severity Changed
Jul 02, 2026 - 19:22 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:22 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD
Analysis Generated
Jun 30, 2026 - 13:35 vuln.today

DescriptionNVD

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

AnalysisAI

Out-of-bounds read in GNOME GLib's GVariant serialiser allows remote attackers to leak a single byte of adjacent memory and to crash applications that deserialise untrusted GVariant data. The flaw sits in gvs_tuple_is_normal() in glib/gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; when that byte falls across a page boundary the process faults, producing a denial of service. No public exploit identified at time of analysis, and EPSS is low (0.26%), but GLib's near-universal presence on Linux systems makes the exposure broad.

Technical ContextAI

GLib is the foundational C utility library underpinning GTK, GNOME, systemd-adjacent tooling and countless Linux applications and daemons. The affected code is GVariant, GLib's type-safe serialization format used heavily for D-Bus message marshalling, GSettings storage and IPC. The bug is a classic CWE-126 buffer over-read: gvs_tuple_is_normal() validates alignment padding while walking a serialized tuple, but its bounds comparison uses '>' where it should use '>=', so a maximally-sized offset is treated as in-bounds and the routine dereferences one byte beyond the allocation. Per NVD CPE data the affected package is cpe:2.3:a:gnome:glib (including 2.88.0), consumed across Red Hat Enterprise Linux 6 through 10 (cpe:2.3:o:redhat:enterprise_linux).

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 (or 2.86.5 on the 2.86 maintenance branch) or later, per the ENISA EUVD fixed-version data; on Red Hat Enterprise Linux apply the distribution glib2 update tracked at https://access.redhat.com/security/cve/CVE-2026-58010 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2492243, with upstream detail at https://gitlab.gnome.org/GNOME/glib/-/issues/3915. Because GLib is a shared system library, patch the OS package and restart or re-link dependent long-running services (D-Bus consumers, desktop session, daemons) so they load the fixed library. No supported source-level workaround exists; as a compensating control, restrict exposure of services that deserialise untrusted GVariant/D-Bus data to remote or low-privilege callers - for example limit D-Bus policy to trusted senders and avoid feeding externally-sourced GVariant blobs to unpatched processes - accepting that this narrows functionality for affected IPC interfaces.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2026-64905 HIGH
7.8
CVE-2023-0817 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

Share

EUVD-2026-40312 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy