CVE Intelligence
Analysis AI-assisted

CVE-2026-58016: GLib: out-of-bounds read via malformed D-Bus introspection XML

A flaw in the GDBus introspection parser of GLib, reached through g_dbus_node_info_new_for_xml(), can be triggered by malformed XML that nests a node element inside method, signal, property or arg elements. According to the record, this leads to an unsigned integer overflow and an out-of-bounds read, causing denial of service. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

GLib is a core library used by GNOME and many Linux applications. CVE-2026-58016 concerns its GIO D-Bus introspection code: g_dbus_node_info_new_for_xml() in gio/gdbusintrospection.c does not handle a node element nested inside method, signal, property or arg elements correctly when parsing malformed XML. The CNA description states that this can cause an unsigned integer overflow and an out-of-bounds read.

Impact

The record describes the impact as denial of service. NVD assigns CVSS 3.1 base score 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which corresponds to network access, low complexity, no privileges and no user interaction, with high confidentiality and availability impact. Red Hat lists a separate CVSS 3.1 score of 7.5. The record also lists the CWE as CWE-191 (Integer Underflow), while the description refers to an overflow, so the weakness classification should be read with care.

  • Confidentiality: the NVD vector rates it as high, but the description itself only describes denial of service.
  • Availability: the description directly reports denial of service.
  • Integrity: rated none in the NVD vector.

Affected products and versions

  • GNOME GLib: listed in the record as versions below 2.88.1.
  • Red Hat Enterprise Linux: listed in the record as versions 6.0, 7.0, 8.0, 9.0 and 10.0. The record does not map these entries to specific minor releases or package builds.

Exploitation status

CISA KEV does not list this CVE. The record contains no confirmed report of active exploitation, and no exploitation in the wild appears in the sources consulted. One GitLab reference is tagged as Exploit in NVD metadata, but the record does not describe any exploit content, so this should not be read as evidence of attacks. The EPSS probability in the record is 0.00545 (percentile 0.44214).

Remediation and mitigation

  • Identify all systems running GLib versions below 2.88.1 and all Red Hat Enterprise Linux systems in the listed range.
  • Apply the updates from your operating system vendor. The record includes many Red Hat errata links, but it does not state which errata fix which build, so check each advisory for the exact package version.
  • Where patching is delayed, reduce exposure by limiting which local or networked components accept D-Bus introspection XML from untrusted sources. This is a general hardening measure and is not stated in the record as an official workaround.
  • Track restarts or crashes of services that use GIO D-Bus introspection until patches are deployed.

Detection guidance

  • Inventory GLib packages and compare them with the vendor advisories.
  • Monitor logs and crash reports of services that parse D-Bus introspection data for unexpected terminations.
  • Review internal components that accept introspection XML from external or less trusted parties and treat unexpected parsing failures as signals for investigation.

Limitations of the available information

  • The record does not give a fixed version for GLib beyond the upper bound of the affected range, and the fixes list is empty.
  • The record does not map Red Hat Enterprise Linux version strings to specific fixed package builds.
  • The description says overflow while the CWE is listed as an integer underflow, and the two Red Hat CVSS scores differ.
  • The EPSS date in the record is later than the publication date and should be verified against the source before reliance.
  • The technical details beyond the description are not provided, so this analysis does not cover reproduction conditions.

Sources: NVD entry, CVE Record, Red Hat CVE page, GNOME GLib issue 3932, Red Hat Bugzilla 2492257.

Frequently asked questions

What does CVE-2026-58016 affect?

According to the record, it affects GNOME GLib versions below 2.88.1 and the Red Hat Enterprise Linux versions listed in the record. The record does not map these to specific package builds.

Is this vulnerability being actively exploited?

CISA KEV does not list it, and the sources consulted contain no confirmed report of active exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.