CVE-2026-58013
published 2026-06-30CVE-2026-58013: A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length…
PriorityP341high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
0.50%
42.6th percentile
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | glib | < 2.88.1 | 2.88.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | glib2.0 | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vendor_redhat6.5MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNOME GLib up to 2.88.0 giochannel.c g_io_channel_read_line_backend buffer over-read (ID 3925 / EUVD-2026-40315)
vuldb·2026-06-30·CVSS 6.5
CVE-2026-58013 [MEDIUM] GNOME GLib up to 2.88.0 giochannel.c g_io_channel_read_line_backend buffer over-read (ID 3925 / EUVD-2026-40315)
A vulnerability was found in GNOME GLib up to 2.88.0. It has been classified as critical. Impacted is the function g_io_channel_read_line_backend of the file giochannel.c. Performing a manipulation results in buffer over-read.
This vulnerability is identified as CVE-2026-58013. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
A flaw was found in GLib.
ghsa_unreviewed·2026-06-30
CVE-2026-58013 [MEDIUM] CWE-126 A flaw was found in GLib.
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
Ubuntu
GLib vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 5.3
CVE-2026-58013 [MEDIUM] GLib vulnerabilities
Title: GLib vulnerabilities
Summary: GLib could be made to crash or expose sensitive information if it
received specially crafted input.
It was discovered that GLib's GDBus authentication mechanism failed to
enforce length limitations on data lines read from a client. An
unauthenticated attacker could exploit this to cause a denial of service
via resource exhaustion. (CVE-2026-15588)
It was discovered that the xdgmime library in GLib had a heap-based
buffer overflow. An attacker-controlled MIME magic file could cause an
out-of-bounds write on little-endian systems. (CVE-2026-16118)
It was discovered that GLib had an off-by-one error in the GVariant
serialiser. An attacker could use this to cause an out-of-bounds read,
leading to information disclosure or a denial of service.
(CVE-2026-
Red Hat
glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
vendor_redhat·2026-04-03·CVSS 6.5
CVE-2026-58013 [MEDIUM] CWE-126 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
Statement: Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue. This flaw can cause a buffer over-read of 8 bytes, leading to an information disclosure of 7 bytes or a denial of service when
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58013 mingw-glib2: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58013 [MEDIUM] CVE-2026-58013 mingw-glib2: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
CVE-2026-58013 mingw-glib2: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ occurs in g_io_channel_read_line_backend() at giochannel.c:1831 when a custom line terminator of length > 1 is set via g_io_channel_set_line_term(). The memcmp call reads line_term_len bytes from nextchar, but the loop condition nextchar < lastchar only guarantees 1 byte is available. When nextchar is within line_term_len - 1 bytes of lastchar, memcmp reads past the GString buffer into ASan redzone / unallocated memory.
Bugzilla
CVE-2026-58013 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58013 [MEDIUM] CVE-2026-58013 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
CVE-2026-58013 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ occurs in g_io_channel_read_line_backend() at giochannel.c:1831 when a custom line terminator of length > 1 is set via g_io_channel_set_line_term(). The memcmp call reads line_term_len bytes from nextchar, but the loop condition nextchar < lastchar only guarantees 1 byte is available. When nextchar is within line_term_len - 1 bytes of lastchar, memcmp reads past the GString buffer into ASan redzone / unallocated memory.
Discussion:
Bugzilla
CVE-2026-58013 glib2: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58013 [MEDIUM] CVE-2026-58013 glib2: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
CVE-2026-58013 glib2: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ occurs in g_io_channel_read_line_backend() at giochannel.c:1831 when a custom line terminator of length > 1 is set via g_io_channel_set_line_term(). The memcmp call reads line_term_len bytes from nextchar, but the loop condition nextchar < lastchar only guarantees 1 byte is available. When nextchar is within line_term_len - 1 bytes of lastchar, memcmp reads past the GString buffer into ASan redzone / unallocated memory.
Bugzilla
CVE-2026-58013 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
bugzilla·2026-06-24·CVSS 6.5
CVE-2026-58013 [MEDIUM] CVE-2026-58013 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
CVE-2026-58013 glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
A heap-buffer-overflow READ occurs in g_io_channel_read_line_backend() at giochannel.c:1831 when a custom line terminator of length > 1 is set via g_io_channel_set_line_term(). The memcmp call reads line_term_len bytes from nextchar, but the loop condition nextchar < lastchar only guarantees 1 byte is available. When nextchar is within line_term_len - 1 bytes of lastchar, memcmp reads past the GString buffer into ASan redzone / unallocated memory.
https://access.redhat.com/errata/RHSA-2026:49512https://access.redhat.com/errata/RHSA-2026:55440https://access.redhat.com/errata/RHSA-2026:57015https://access.redhat.com/errata/RHSA-2026:58981https://access.redhat.com/errata/RHSA-2026:61766https://access.redhat.com/errata/RHSA-2026:61783https://access.redhat.com/errata/RHSA-2026:63135https://access.redhat.com/errata/RHSA-2026:63138https://access.redhat.com/errata/RHSA-2026:63140https://access.redhat.com/errata/RHSA-2026:65762https://access.redhat.com/errata/RHSA-2026:65763https://access.redhat.com/errata/RHSA-2026:65767https://access.redhat.com/errata/RHSA-2026:65768https://access.redhat.com/errata/RHSA-2026:65769https://access.redhat.com/errata/RHSA-2026:65770https://access.redhat.com/errata/RHSA-2026:65771https://access.redhat.com/errata/RHSA-2026:65773https://access.redhat.com/errata/RHSA-2026:66018https://access.redhat.com/errata/RHSA-2026:72394https://access.redhat.com/errata/RHSA-2026:72395https://access.redhat.com/errata/RHSA-2026:72399https://access.redhat.com/errata/RHSA-2026:72470https://access.redhat.com/errata/RHSA-2026:72475https://access.redhat.com/errata/RHSA-2026:72476https://access.redhat.com/errata/RHSA-2026:72502https://access.redhat.com/errata/RHSA-2026:73859https://access.redhat.com/errata/RHSA-2026:73909https://access.redhat.com/errata/RHSA-2026:73929https://access.redhat.com/errata/RHSA-2026:73930https://access.redhat.com/errata/RHSA-2026:73959https://access.redhat.com/errata/RHSA-2026:73960https://access.redhat.com/errata/RHSA-2026:73961https://access.redhat.com/errata/RHSA-2026:73962https://access.redhat.com/errata/RHSA-2026:74458https://access.redhat.com/errata/RHSA-2026:74459https://access.redhat.com/errata/RHSA-2026:74460https://access.redhat.com/errata/RHSA-2026:74461https://access.redhat.com/errata/RHSA-2026:74462https://access.redhat.com/errata/RHSA-2026:74463https://access.redhat.com/errata/RHSA-2026:74674https://access.redhat.com/errata/RHSA-2026:74677https://access.redhat.com/errata/RHSA-2026:74678https://access.redhat.com/errata/RHSA-2026:74679https://access.redhat.com/errata/RHSA-2026:74681https://access.redhat.com/errata/RHSA-2026:74683https://access.redhat.com/errata/RHSA-2026:74685https://access.redhat.com/errata/RHSA-2026:74687https://access.redhat.com/errata/RHSA-2026:74688https://access.redhat.com/errata/RHSA-2026:74771https://access.redhat.com/errata/RHSA-2026:75652https://access.redhat.com/errata/RHSA-2026:75654https://access.redhat.com/errata/RHSA-2026:75655https://access.redhat.com/errata/RHSA-2026:75657https://access.redhat.com/errata/RHSA-2026:75658https://access.redhat.com/errata/RHSA-2026:75659https://access.redhat.com/errata/RHSA-2026:75660https://access.redhat.com/errata/RHSA-2026:76042https://access.redhat.com/errata/RHSA-2026:80769https://access.redhat.com/errata/RHSA-2026:80771https://access.redhat.com/errata/RHSA-2026:82059https://access.redhat.com/errata/RHSA-2026:82061https://access.redhat.com/errata/RHSA-2026:82066https://access.redhat.com/errata/RHSA-2026:82304https://access.redhat.com/errata/RHSA-2026:82322https://access.redhat.com/errata/RHSA-2026:82336https://access.redhat.com/errata/RHSA-2026:82347https://access.redhat.com/errata/RHSA-2026:82354https://access.redhat.com/errata/RHSA-2026:82368https://access.redhat.com/errata/RHSA-2026:82371https://access.redhat.com/errata/RHSA-2026:82372https://access.redhat.com/errata/RHSA-2026:82415https://access.redhat.com/errata/RHSA-2026:82857https://access.redhat.com/errata/RHSA-2026:82888https://access.redhat.com/security/cve/CVE-2026-58013https://bugzilla.redhat.com/show_bug.cgi?id=2492248https://gitlab.gnome.org/GNOME/glib/-/issues/3925
2026-06-30
Published