CVE-2026-58011
published 2026-06-30CVE-2026-58011: A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.34%
26.6th percentile
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | glib | < 2.88.1 | 2.88.1 |
| gnome | glib | < 2.86.5 | 2.86.5 |
| gnome | glib | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
vendor_redhat·2026-03-27·CVSS 6.5
CVE-2026-58011 [MEDIUM] CWE-125 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Statement: Any applications that allow a user to submit a date to `g_date_time_add_full()` and later call any getter functions, such as `g_date_time_get_month()` or `g_date_time_get_year()`, with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors th
GHSA
A flaw was found in GLib.
ghsa_unreviewed·2026-06-30
CVE-2026-58011 [MEDIUM] CWE-125 A flaw was found in GLib.
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
VulDB
GNOME GLib prior 2.86.5/2.88.1 glib/gdatetime.c g_date_time_get_ymd out-of-bounds (ID 3917 / EUVD-2026-40313)
vuldb·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] GNOME GLib prior 2.86.5/2.88.1 glib/gdatetime.c g_date_time_get_ymd out-of-bounds (ID 3917 / EUVD-2026-40313)
A vulnerability classified as critical was found in GNOME GLib. This vulnerability affects the function g_date_time_get_ymd of the file glib/gdatetime.c. The manipulation results in out-of-bounds read.
This vulnerability is known as CVE-2026-58011. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_get
Bugzilla
CVE-2026-58011 glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
CVE-2026-58011 glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_ge
Bugzilla
CVE-2026-58011 mingw-glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 mingw-glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
CVE-2026-58011 mingw-glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_t
Bugzilla
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
bugzilla·2026-06-24·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_get_year()) is subsequently called, the internal g_date_time_get_ymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.
2026-06-30
Published