EUVD-2026-45266
GHSA-cp7g-r78m-cc2g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Local attacker-controlled magic file (AV:L) parsed only when an app performs MIME detection (UI:R); OOB write corrupts memory (I:H/A:H) with no data disclosure (C:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
AnalysisAI
Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a little-endian CPU (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, 7.1) correctly frames this as a locally-triggered availability/integrity issue rather than a remote code execution primitive: exploitation requires the ability to write a file into a local user-writable XDG data path and for an application to then parse it (UI:R), and it only fires on little-endian systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a shared little-endian Linux host, a local user writes a crafted magic database to $XDG_DATA_HOME/mime/magic, then opens a file manager or launches an application that calls g_content_type_guess(); parsing the malicious byte-swap entry triggers a 2-byte out-of-bounds heap write, crashing the process or corrupting adjacent heap memory. If a higher-privileged process is coaxed into parsing the attacker's magic file, the same corruption could be escalated. … |
| Remediation | No vendor-released patched version was identified in the provided data; the upstream fix is tracked as a freedesktop xdgmime work item (https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41) and a released patched version is not independently confirmed, so monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-16118) and apply the xdgmime/GLib update for your RHEL 7/8/9/10 release as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory systems running GLib and xdgmime by querying package managers (rpm, dpkg, or equivalent per distribution); identify applications using MIME type detection functions; restrict physical access and limit SSH access to multi-user systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today