CVE-2026-58010

Name
CVE-2026-58010
Description
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
secalert@redhat.com https://access.redhat.com/security/cve/CVE-2026-58010
secalert@redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2492243
secalert@redhat.com https://gitlab.gnome.org/GNOME/glib/-/issues/3915
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:49512
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:55440
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:57015
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:58981
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:61766
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:61783
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:63135
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:63138
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:63140
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65762
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65768
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65770
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65773
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65763
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65767
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65769
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:65771
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:66018
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72394
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72395
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72399
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72470
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72475
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72476
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:72502
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73859
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73909
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73929
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73930
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73959
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73960
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73961
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:73962
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74458
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74459
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74460
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74461
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74462
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74463
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74674
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74677
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74678
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74679
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74681
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74683
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74685
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74687
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74688
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:74771
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75652
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75654
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75655
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75657
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75658
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75659
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:75660
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:76042
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:80769
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:80771
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82059
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82061
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82066
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82304
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82322
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82336
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82347
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82354
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82368
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82371
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82372
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82415
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82857
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:82888

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* glib >= None < 2.86.5
cpe:2.3:a:gnome:glib:2.88.0:*:*:*:*:*:*:* glib == None == 2.88.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* enterprise_linux == None == 6.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* enterprise_linux == None == 7.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* enterprise_linux == None == 8.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* enterprise_linux == None == 9.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* enterprise_linux == None == 10.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
glib edge-main 2.88.0-r1 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.88.0-r0 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.86.4-r0 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.86.3-r1 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.86.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.2-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.2-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.1-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.0-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.0-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.4-r2 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.4-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.4-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.2-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.2-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.1-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.0-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.5-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.5-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.4-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.3-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.2-r1 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.2-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.80.1-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib edge-main 2.66.6-r0 None possibly vulnerable
glib edge-main 2.62.5-r0 None possibly vulnerable
glib edge-main 2.60.4-r0 None possibly vulnerable
glib 3.23-main 2.86.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.22-main 2.84.4-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.22-main 2.84.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.22-main 2.80.1-r0 None possibly vulnerable
glib 3.22-main 2.66.6-r0 None possibly vulnerable
glib 3.22-main 2.62.5-r0 None possibly vulnerable
glib 3.22-main 2.60.4-r0 None possibly vulnerable
glib 3.21-main 2.82.5-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.82.4-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.82.3-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.82.2-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.80.1-r0 None possibly vulnerable
glib 3.21-main 2.66.6-r0 None possibly vulnerable
glib 3.21-main 2.62.5-r0 None possibly vulnerable
glib 3.21-main 2.60.4-r0 None possibly vulnerable
glib 3.20-main 2.80.5-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib 3.20-main 2.80.1-r0 None possibly vulnerable
glib 3.20-main 2.66.6-r0 None possibly vulnerable
glib 3.20-main 2.62.5-r0 None possibly vulnerable
glib 3.20-main 2.60.4-r0 None possibly vulnerable
glib 3.19-main 2.78.6-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib 3.19-main 2.78.5-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib 3.19-main 2.66.6-r0 None possibly vulnerable
glib 3.19-main 2.62.5-r0 None possibly vulnerable
glib 3.19-main 2.60.4-r0 None possibly vulnerable