CVE-2026-58016

Name
CVE-2026-58016
Description
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a <node> element nested within other elements like <method>, <signal>, <property> or <arg>. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory https://access.redhat.com/security/cve/CVE-2026-58016
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2492257
Exploit https://gitlab.gnome.org/GNOME/glib/-/issues/3932

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* glib >= None < 2.88.1
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* enterprise_linux == None == 6.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* enterprise_linux == None == 7.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* enterprise_linux == None == 8.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* enterprise_linux == None == 9.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* enterprise_linux == None == 10.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
glib edge-main 2.88.0-r1 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.88.0-r0 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.87.5-r0 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.86.4-r0 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.86.3-r1 team/gnome <achill@achill.org> possibly vulnerable
glib edge-main 2.86.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.2-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.2-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.1-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.0-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.86.0-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.4-r2 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.4-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.4-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.2-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.2-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.1-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.84.0-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.5-r1 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.5-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.4-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.3-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.2-r1 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.82.2-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib edge-main 2.80.1-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib edge-main 2.66.6-r0 None possibly vulnerable
glib edge-main 2.62.5-r0 None possibly vulnerable
glib edge-main 2.60.4-r0 None possibly vulnerable
glib 3.23-main 2.86.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.22-main 2.84.4-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.22-main 2.84.3-r0 team/gnome <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.22-main 2.80.1-r0 None possibly vulnerable
glib 3.22-main 2.66.6-r0 None possibly vulnerable
glib 3.22-main 2.62.5-r0 None possibly vulnerable
glib 3.22-main 2.60.4-r0 None possibly vulnerable
glib 3.21-main 2.82.5-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.82.4-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.82.3-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.82.2-r0 Pablo Correa Gómez <pabloyoyoista@postmarketos.org> possibly vulnerable
glib 3.21-main 2.80.1-r0 None possibly vulnerable
glib 3.21-main 2.66.6-r0 None possibly vulnerable
glib 3.21-main 2.62.5-r0 None possibly vulnerable
glib 3.21-main 2.60.4-r0 None possibly vulnerable
glib 3.20-main 2.80.5-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib 3.20-main 2.80.1-r0 None possibly vulnerable
glib 3.20-main 2.66.6-r0 None possibly vulnerable
glib 3.20-main 2.62.5-r0 None possibly vulnerable
glib 3.20-main 2.60.4-r0 None possibly vulnerable
glib 3.19-main 2.78.6-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib 3.19-main 2.78.5-r0 Pablo Correa Gómez <ablocorrea@hotmail.com> possibly vulnerable
glib 3.19-main 2.66.6-r0 None possibly vulnerable
glib 3.19-main 2.62.5-r0 None possibly vulnerable
glib 3.19-main 2.60.4-r0 None possibly vulnerable