Skip to main content

GLib EUVDEUVD-2026-40312

| CVE-2026-58010 HIGH
Buffer Over-read (CWE-126)
2026-06-30 secalert@redhat.com GHSA-m7rp-473c-296x
Buffer Overflow Denial Of Service Information Disclosure Red Hat Enterprise Linux Glib Gnome
8.2
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach GVariant-parsing service (e.g. D-Bus)
  2. Delivery
    Send crafted tuple with malformed padding
  3. Exploit
    Trigger off-by-one over-read in gvs_tuple_is_normal
  4. Execution
    Leak adjacent byte or fault on page boundary
  5. Impact
    Information disclosure or process crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-126
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
Exploitation Conditions

Exploitation requires that a vulnerable GLib version (below 2.88.1 / 2.86.5) deserialises attacker-controlled GVariant data - most realistically via a D-Bus service, GSettings input, or any application that parses externally-sourced GVariant tuples through gvs_tuple_is_normal(). The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required to reach the parser, but the practical prerequisite is an exposed code path that accepts untrusted serialized GVariant input. Limiting factors: the information disclosure is exactly one byte, and the denial of service only materialises when that single out-of-bounds byte falls across a page boundary into unmapped memory - otherwise the read is silent, making reliable crashing non-deterministic and full memory disclosure impossible.
Impact

Signals are moderate and partially conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) implies trivially reachable network exploitation with high availability impact, yet the description limits the actual damage to a 1-byte information disclosure plus a conditional crash that only occurs when the over-read straddles a page boundary - making A:H arguably generous for what is a low-reliability, single-byte over-read. EPSS is low at 0.26% (18th percentile) and CISA SSVC records Exploitation: none, Technical Impact: partial, though Automatable: yes reflects that parsing untrusted GVariant/D-Bus input is programmatic. There is no KEV listing and no POC, so this is a real-but-not-urgent priority: patch on normal cadence given GLib's ubiquity, rather than emergency response. Note the AV:N rating assumes the vulnerable parser is fed attacker-controlled data over a network/IPC boundary (e.g. D-Bus); locally-scoped deployments face lower real risk than the 8.2 suggests.
Exploit ScenarioDerived

An attacker sends a crafted GVariant-serialised message (for example over a D-Bus interface or another IPC path that deserialises untrusted GVariant data) whose tuple padding is sized to trigger the off-by-one read in gvs_tuple_is_normal(). The over-read leaks one adjacent byte back to the attacker or, if the byte lies on an unmapped page, crashes the consuming process, denying service. No public POC is currently available and exploitation is network-reachable but low-reliability given the single-byte, page-boundary-dependent impact.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 02, 2026

Out-of-bounds read in GNOME GLib's GVariant serialiser allows remote attackers to leak a single byte of adjacent memory and to crash applications that deserialise untrusted GVariant data. The flaw sits in gvs_tuple_is_normal() in glib/gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; when that byte falls across a page boundary the process faults, producing a denial of service. No public exploit identified at time of analysis, and EPSS is low (0.26%), but GLib's near-universal presence on Linux systems makes the exposure broad.

Earlier versions of this analysis (2)
v2 Jul 02, 2026 - 19:29 cvss changed CVSS 8.2

Out-of-bounds read in GNOME GLib's GVariant deserialiser lets remote attackers leak one byte of adjacent memory and crash affected applications by supplying malformed serialised GVariant data. The defect lives in gvs_tuple_is_normal() in gvariant-serialiser.c, where an alignment-padding bounds check uses '>' instead of '>=', reading one byte past the buffer; because GVariant underpins D-Bus/GDBus and many GNOME and Linux services, any process that parses untrusted GVariant input is exposed. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.26%), but the network CVSS vector and high availability impact drive the 8.2 score.

v1 Jun 30, 2026 - 13:35 CVSS 6.5

Off-by-one error in GLib's GVariant serializer exposes any application that deserializes untrusted GVariant tuple data to a 1-byte out-of-bounds read in gvs_tuple_is_normal(). Applications accepting GVariant input from network sources (e.g., D-Bus bridges, GSettings over untrusted channels) are reachable without authentication or user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). An attacker supplying a crafted GVariant tuple can leak a single byte of adjacent memory or crash the target process if the overread crosses a page boundary, yielding denial of service. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 (or 2.86.5 on the 2.86 maintenance branch) or later, per the ENISA EUVD fixed-version data; on Red Hat Enterprise Linux apply the distribution glib2 update tracked at https://access.redhat.com/security/cve/CVE-2026-58010 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2492243, with upstream detail at https://gitlab.gnome.org/GNOME/glib/-/issues/3915. Because GLib is a shared system library, patch the OS package and restart or re-link dependent long-running services (D-Bus consumers, desktop session, daemons) so they load the fixed library. No supported source-level workaround exists; as a compensating control, restrict exposure of services that deserialise untrusted GVariant/D-Bus data to remote or low-privilege callers - for example limit D-Bus policy to trusted senders and avoid feeding externally-sourced GVariant blobs to unpatched processes - accepting that this narrows functionality for affected IPC interfaces.

Affected VersionsENISA

glib 0 <2.88.1
glib 0 <2.86.5

Affected Packages

euvd glib fix: 2.86.5, 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib is the foundational C utility library underpinning GTK, GNOME, systemd-adjacent tooling and countless Linux applications and daemons. The affected code is GVariant, GLib's type-safe serialization format used heavily for D-Bus message marshalling, GSettings storage and IPC. The bug is a classic CWE-126 buffer over-read: gvs_tuple_is_normal() validates alignment padding while walking a serialized tuple, but its bounds comparison uses '>' where it should use '>=', so a maximally-sized offset is treated as in-bounds and the routine dereferences one byte beyond the allocation. Per NVD CPE data the affected package is cpe:2.3:a:gnome:glib (including 2.88.0), consumed across Red Hat Enterprise Linux 6 through 10 (cpe:2.3:o:redhat:enterprise_linux).

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY MEDIUM
NVD 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI 8.2 HIGH

Untrusted GVariant/D-Bus input is remotely reachable without auth or interaction (AV:N/AC:L/PR:N/UI:N); one-byte over-read gives C:L, no integrity impact, and a page-boundary crash yields A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat 6.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

3
Severity Changed
Jul 02, 2026 - 19:22 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:22 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

Executive ViewAI

Why It Matters

GNOME GLib contains a vulnerability allowing attackers to extract memory contents and disable critical applications across the enterprise by exploiting untrusted data handling. The vulnerability affects operating system and application layers due to GLib's fundamental role in Linux infrastructure. Patch deployment should be prioritized to minimize data exposure and operational disruption risks.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Prevalence
Ubiquitous
core GNOME/GTK library present on nearly all Linux systems
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2022-2124 HIGH POC
7.8
CVE-2022-2175 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58010 ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/374840 REF https://access.redhat.com/errata/RHSA-2026:49512 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-58010 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492243 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3915

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy