Skip to main content

GLib EUVDEUVD-2026-40313

| CVE-2026-58011 HIGH
Out-of-bounds Read (CWE-125)
2026-06-30 secalert@redhat.com GHSA-8xmh-8wfg-9f6j
Buffer Overflow Denial Of Service Information Disclosure Red Hat Enterprise Linux Glib Gnome
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Submit malformed date/interval to service
  2. Delivery
    GDateTime arithmetic via g_date_time_add_full
  3. Exploit
    Invalid GDateTime read by g_date_time_get_ymd
  4. Execution
    2-byte out-of-bounds read
  5. Impact
    Corrupted date output / process crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that a GLib-consuming application (1) passes attacker-influenced values into g_date_time_add_full() such that an invalid/out-of-range GDateTime is produced, and (2) subsequently calls g_date_time_get_ymd() on that object to read the year/month/day. The specific trigger is the invalid GDateTime state, not a library configuration flag. Limiting factors: the vulnerable code is a library primitive, so real-world reachability depends on whether the deployed application actually exposes date arithmetic to untrusted input and reads it back - many programs never feed untrusted data through this exact path. The realized impact is bounded to a 2-byte over-read causing corrupted output or potential DoS (no confidentiality or integrity impact per the vector), so even where reachable it does not yield code execution or memory disclosure of sensitive data.
Impact

The signals are mixed and warrant nuance. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H, score 7.5) rates this as a network, no-privilege, high-availability-impact issue, but the description characterizes the effect as a 2-byte over-read that 'potentially' and 'may' lead to DoS - language that implies conditional, application-dependent impact rather than reliable A:H. The network vector is only realistic where an application feeds attacker-controlled values into g_date_time_add_full() and then calls g_date_time_get_ymd(); this is a library primitive, so reachability depends entirely on the consuming application - verify exposure per deployment. Supporting signals are modest: EPSS is 0.27% (19th percentile), SSVC lists Exploitation=poc (not active), Automatable=yes, and Technical Impact=partial. No CISA KEV listing. Net: this is a moderate-priority patch-in-normal-cycle issue for most environments - a real bug with a POC and broad RHEL footprint, but low measured exploitation probability and a DoS-only, over-read impact rather than code execution or data disclosure. The A:H rating appears somewhat generous relative to the described 2-byte read.
Exploit ScenarioDerived

An application built on GLib accepts an attacker-influenced date/interval and performs date arithmetic with g_date_time_add_full(), producing an invalid GDateTime; when it then formats or reads the result via g_date_time_get_ymd(), the 2-byte over-read corrupts the computed year/month/day and can crash or misbehave the process. A proof-of-concept is reported by SSVC, and because the flow is automatable, an attacker could repeatedly submit malformed date inputs to a network-facing service to degrade availability.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 02, 2026

Out-of-bounds read of two bytes in GLib's g_date_time_get_ymd() (glib/gdatetime.c) lets attackers corrupt date output and trigger logic errors that may cause denial of service when an application processes an invalid GDateTime produced by g_date_time_add_full(). It affects the GNOME GLib core utility library shipped across Red Hat Enterprise Linux 6 through 10, with fixes in GLib 2.88.1 and 2.86.5. There is publicly available exploit code exists per SSVC (proof-of-concept), no confirmed active exploitation, and EPSS is low at 0.27% (19th percentile).

Earlier versions of this analysis (2)
v2 Jul 02, 2026 - 19:28 cvss changed CVSS 7.5

Denial of service in GNOME GLib (versions before 2.88.1 and before 2.86.5) arises when g_date_time_get_ymd() processes an invalid GDateTime object created by g_date_time_add_full(), triggering a 2-byte out-of-bounds read (CWE-125) that corrupts date output and can cascade into logic errors. Any application linking GLib and performing arithmetic on attacker-influenced dates is exposed, and because GLib underpins GNOME and countless Linux services the blast radius is broad. Publicly available exploit code exists (SSVC: PoC) but the flaw is not in CISA KEV, and EPSS is low at 0.27% (19th percentile), indicating no evidence of widespread exploitation.

v1 Jun 30, 2026 - 13:35 CVSS 6.5

Out-of-bounds read in GLib's g_date_time_get_ymd function (glib/gdatetime.c) allows remote attackers to corrupt date output and induce logic errors leading to denial of service. The flaw is triggered when an invalid GDateTime object - produced by a prior call to g_date_time_add_full with arithmetic that yields out-of-range date components - is subsequently processed by g_date_time_get_ymd, which reads 2 bytes beyond valid data boundaries (CWE-125). No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 (or 2.86.5 for the 2.86.x branch) which fixes the out-of-bounds read; consult the upstream tracker at https://gitlab.gnome.org/GNOME/glib/-/issues/3917 and the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58011 for distribution-packaged builds. On Red Hat Enterprise Linux 6-10, apply the vendor GLib errata via the normal package manager (dnf/yum update glib2) once released and restart or rebuild dependent services so they load the patched library. If patching must be delayed, the practical compensating control is at the application layer: validate or bound date values before passing them to g_date_time_add_full() and avoid calling g_date_time_get_ymd() on GDateTime objects that resulted from unbounded arithmetic on untrusted input - the trade-off is code changes in each consuming application rather than a single library update. Because the impact is a bounded read leading to at most DoS, restricting or rate-limiting the untrusted inputs that drive date arithmetic (the side effect being reduced functionality for legitimate large date ranges) reduces exposure until the library is updated.

Affected VersionsENISA

glib 0 <2.88.1
glib 0 <2.86.5

Affected Packages

euvd glib fix: 2.86.5, 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib is the foundational low-level C utility library underpinning GNOME and countless Linux applications, providing data structures, type systems, and the GDateTime API for date/time arithmetic. The root cause is CWE-125 (Out-of-Bounds Read): g_date_time_add_full() can produce a GDateTime with out-of-range internal fields, and when g_date_time_get_ymd() subsequently indexes into GLib's internal days-in-month/day-of-year lookup tables using those unvalidated fields, it reads two bytes past the intended bounds. The affected code path is entirely within libglib, so any consumer that performs date arithmetic and then reads year/month/day is potentially exposed. Per the NVD CPE data, affected products are cpe:2.3:a:gnome:glib (including 2.88.0) and Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0 and 10.0 which bundle GLib as an OS component.

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY MEDIUM
NVD 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 3.7 LOW

AC:H because a specifically invalid GDateTime must be crafted through g_date_time_add_full and reached via a consuming app; A:L reflects a bounded 2-byte over-read causing at most conditional DoS; no C/I impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Red Hat 6.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Severity Changed
Jul 02, 2026 - 19:22 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:22 NVD
6.5 (MEDIUM) 7.5 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.

Executive ViewAI

Why It Matters

GLib, a foundational library embedded in Red Hat Enterprise Linux 6 through 10, contains a memory access vulnerability that corrupts date processing functions and can trigger denial-of-service conditions in dependent applications. Organizations running these Linux distributions require immediate identification of exposed systems and applications using the GDateTime API. While publicly available exploit code exists, no confirmed active exploitation has been observed, and empirical exploitation likelihood remains low.

Business Impact: Medium
Compensating Controls

Vendor-released patch: GLib 2.88.1 (RHEL 8 and later) and 2.86.5 (RHEL 6-7). Apply to all affected systems immediately after pre-production validation.

Threat Intelligence Overview

EPSS Score
0.3%
Top 81% exploitable
Prevalence
Ubiquitous
core GNOME/Linux library bundled in RHEL 6-10 and most desktops
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58011 ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/374851 REF https://access.redhat.com/errata/RHSA-2026:49512 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-58011 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492245 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3917 REF https://gitlab.gnome.org/GNOME/glib/-/work_items/3917

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy