Skip to main content

GLib EUVDEUVD-2026-40316

| CVE-2026-58014 HIGH
Off-by-one Error (CWE-193)
2026-06-30 secalert@redhat.com GHSA-h88q-m8mm-7243
Denial Of Service Red Hat Enterprise Linux Glib Gnome
8.6
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft key file with empty-value key
  2. Delivery
    Deliver to GLib-based application
  3. Exploit
    Application calls g_key_file_get_locale_string_list()
  4. Execution
    Off-by-one over-read crosses page boundary
  5. Impact
    Process crash / 1-byte info leak (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-193
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
Exploitation Conditions

Exploitation requires that a GLib-linked application actually call g_key_file_get_locale_string_list() while parsing an attacker-controlled key file that contains a key with an empty value - that empty-value condition is the specific trigger. The denial-of-service outcome further depends on the affected buffer allocation sitting adjacent to a page boundary so the 1-byte over-read reaches unmapped memory; otherwise the read is silently in-bounds and benign. Limiting factors: the attacker must deliver or influence the key file consumed by the target, and impact is confined to a crash plus a single-byte read rather than memory corruption or code execution. Despite the CVSS AV:N/PR:N/UI:N metrics, real-world exploitation is gated by whether the deployed application exposes key-file parsing to untrusted input - verify this per application rather than assuming remote unauthenticated reachability.
Impact

Signals conflict and should be reconciled before treating this as a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H) yields 8.6 and implies trivial remote unauthenticated exploitation, but the description makes clear the trigger is parsing a crafted key file - which in practice requires an application to load attacker-supplied input, closer to local/UI-mediated access than raw network reachability; verify the vector against real deployment context. SSVC frames it as exploitation=poc, automatable=yes, technical impact=partial, consistent with a reliable crash rather than code execution. EPSS is low (0.24%) and the CVE is not in CISA KEV, so there is no confirmed active exploitation. Net: the realistic worst case is denial of service plus a 1-byte info leak, not RCE - a moderate-priority patch item elevated mainly by GLib's enormous deployment footprint, not by exploitation likelihood.
Exploit ScenarioDerived

An attacker crafts a key file (e.g., a .desktop or .ini-style config) containing a key with an empty locale string-list value and gets a GLib-based application to load it - for instance via a malicious downloaded launcher, an imported profile, or a config path an application reads automatically. When g_key_file_get_locale_string_list() parses it and the off-by-one over-read lands on a page boundary, the process crashes (DoS); public POC-level exploit code exists per SSVC, though only a partial technical impact is expected.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 01, 2026

Denial of service (and a 1-byte out-of-bounds read) in GNOME GLib before 2.88.1 arises from an off-by-one error in g_key_file_get_locale_string_list() in gkeyfile.c when a parsed key file contains an empty value. Any application built on GLib that loads attacker-influenced .desktop/.ini-style key files can be crashed if the over-read crosses a page boundary, with a minor information-disclosure component from the single out-of-bounds byte. Publicly available exploit code exists (SSVC 'poc'), but it is not on CISA KEV and EPSS is low (0.24%, 15th percentile), indicating no evidence of widespread active exploitation.

Earlier versions of this analysis (2)
v2 Jul 01, 2026 - 18:16 cvss changed CVSS 8.6

Denial of service and 1-byte out-of-bounds read in GNOME GLib affects the g_key_file_get_locale_string_list function when parsing a key file that contains an empty value, stemming from an off-by-one error in gkeyfile.c. Any application built on GLib (pervasive across GNOME and Linux userspace) that loads attacker-influenced .desktop/.ini-style key files can be crashed when the over-read crosses a page boundary. SSVC classifies exploitation as proof-of-concept with partial technical impact; there is no public exploit weaponization and EPSS is low (0.24%, 15th percentile), and it is not listed in CISA KEV.

v1 Jun 30, 2026 - 13:31 CVSS 7.3

Out-of-bounds memory access in GLib's GKeyFile parser (g_key_file_get_locale_string_list in gkeyfile.c) lets an attacker who controls a parsed key file trigger a 1-byte over-read, and a crash when the read crosses a page boundary, causing denial of service. The flaw stems from an off-by-one error when a key file contains an empty value, and was reported by Red Hat; no public exploit identified at time of analysis. GLib is a foundational C library underpinning GNOME and countless Linux applications, so the reach is broad even though impact is limited to memory disclosure and DoS.

RemediationAI

Upgrade GLib to 2.88.1 or later, which contains the upstream fix; the patch is confirmed available from the vendor. On Red Hat Enterprise Linux, apply the distribution's updated glib2 package as it is released and tracked at https://access.redhat.com/security/cve/CVE-2026-58014 (details in Bugzilla 2492255 and GNOME issue 3930) rather than building from source, so the OS-integrated library is replaced consistently. Until packages land, reduce exposure by restricting which key files applications parse - avoid loading .desktop or .ini/key files from untrusted or user-writable locations, and treat network- or upload-supplied config files as hostile; the trade-off is that legitimate workflows that consume such files (custom launchers, imported profiles) must be curtailed or sandboxed. Because the impact is primarily a crash, running affected parsers under process supervision/auto-restart limits DoS blast radius but does not address the underlying out-of-bounds read.

Affected VersionsENISA

glib 0 <2.88.1

Affected Packages

euvd glib fix: 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib is the low-level C utility library underpinning GNOME and a vast amount of Linux desktop and server software; its GKeyFile parser handles the INI-style 'key file' format used by .desktop entries, systemd-adjacent configs, and many application settings. The flaw is CWE-193 (Off-by-One Error): g_key_file_get_locale_string_list() mishandles the terminating/boundary index of a locale string list when a value is empty, reading one byte past the intended buffer. In most cases this reads adjacent in-bounds heap memory harmlessly, but when the allocation sits at the end of a mapped page the extra byte touches unmapped memory and triggers a segfault, producing the denial-of-service condition. CPE data confirms the upstream product cpe:2.3:a:gnome:glib and downstream exposure across Red Hat Enterprise Linux 6 through 10.

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY HIGH
NVD 8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vuln.today AI 6.8 MEDIUM

Trigger is parsing an attacker-supplied key file, so AV:L rather than N; an out-of-bounds read has no integrity impact (I:N), a single leaked byte gives C:L, and the reliable crash gives A:H.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat 7.3 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

2
CVSS changed
Jul 01, 2026 - 18:07 NVD
7.3 (HIGH) 8.6 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

Executive ViewAI

Why It Matters

A vulnerability in GNOME GLib enables attackers to disable applications and extract sensitive data through malicious configuration files; publicly available exploit code exists. The flaw affects organizations broadly through many enterprise applications and Linux services that depend on GLib. Immediate patching to version 2.88.1 is required to protect operational stability across the infrastructure.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 85% exploitable
Prevalence
Ubiquitous
core GNOME/Linux base library shipped across virtually all Linux distributions
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

43
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +43
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-19906 HIGH POC
7.5
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58014 ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/374861 REF https://access.redhat.com/errata/RHSA-2026:49512 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:66357 REF https://access.redhat.com/errata/RHSA-2026:70586 REF https://access.redhat.com/errata/RHSA-2026:70646 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73851 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73866 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:77320 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-58014 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492255 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3930

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy