CVE-2026-58014
published 2026-06-30CVE-2026-58014: A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with…
PriorityP347high8.6CVSS 3.1
AVNACLPRNUINSUCLILAH
EPSS
0.56%
46.2th percentile
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | glib | < 2.88.1 | 2.88.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | glib2.0 | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat7.3HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GLib vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 5.3
CVE-2026-58013 [MEDIUM] GLib vulnerabilities
Title: GLib vulnerabilities
Summary: GLib could be made to crash or expose sensitive information if it
received specially crafted input.
It was discovered that GLib's GDBus authentication mechanism failed to
enforce length limitations on data lines read from a client. An
unauthenticated attacker could exploit this to cause a denial of service
via resource exhaustion. (CVE-2026-15588)
It was discovered that the xdgmime library in GLib had a heap-based
buffer overflow. An attacker-controlled MIME magic file could cause an
out-of-bounds write on little-endian systems. (CVE-2026-16118)
It was discovered that GLib had an off-by-one error in the GVariant
serialiser. An attacker could use this to cause an out-of-bounds read,
leading to information disclosure or a denial of service.
(CVE-2026-
Red Hat
glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
vendor_redhat·2026-04-07·CVSS 7.3
CVE-2026-58014 [HIGH] CWE-193 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Statement: Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.
Mitigation: To mitigate this vu
GHSA
A flaw was found in GLib.
ghsa_unreviewed·2026-06-30
CVE-2026-58014 [HIGH] CWE-193 A flaw was found in GLib.
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
VulDB
GNOME GLib up to 2.88.0 gkeyfile.c g_key_file_get_locale_string_list off-by-one (ID 3930 / EUVD-2026-40316)
vuldb·2026-06-30·CVSS 7.3
CVE-2026-58014 [HIGH] GNOME GLib up to 2.88.0 gkeyfile.c g_key_file_get_locale_string_list off-by-one (ID 3930 / EUVD-2026-40316)
A vulnerability labeled as critical has been found in GNOME GLib up to 2.88.0. This affects the function g_key_file_get_locale_string_list of the file gkeyfile.c. Executing a manipulation can lead to off-by-one.
This vulnerability is registered as CVE-2026-58014. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58014 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
bugzilla·2026-06-30·CVSS 7.3
CVE-2026-58014 [HIGH] CVE-2026-58014 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
CVE-2026-58014 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ of 1 byte occurs in g_key_file_get_locale_string_list() at gkeyfile.c:2464 when the resolved locale string value is an empty string (""). The function computes len = strlen(value) which yields 0, then accesses value[len - 1]. Since len is gsize(unsigned), len - 1 wraps to SIZE_MAX, causing a read of 1 byte before the heap allocation (under-read). Any application that loads a key file from untrusted input and calls g_key_file_get_loc
Bugzilla
CVE-2026-58014 glib2: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
bugzilla·2026-06-30·CVSS 7.3
CVE-2026-58014 [HIGH] CVE-2026-58014 glib2: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
CVE-2026-58014 glib2: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ of 1 byte occurs in g_key_file_get_locale_string_list() at gkeyfile.c:2464 when the resolved locale string value is an empty string (""). The function computes len = strlen(value) which yields 0, then accesses value[len - 1]. Since len is gsize(unsigned), len - 1 wraps to SIZE_MAX, causing a read of 1 byte before the heap allocation (under-read). Any application that loads a key file from untrusted input and calls g_key_file_get_lo
Bugzilla
CVE-2026-58014 mingw-glib2: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
bugzilla·2026-06-30·CVSS 7.3
CVE-2026-58014 [HIGH] CVE-2026-58014 mingw-glib2: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
CVE-2026-58014 mingw-glib2: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ of 1 byte occurs in g_key_file_get_locale_string_list() at gkeyfile.c:2464 when the resolved locale string value is an empty string (""). The function computes len = strlen(value) which yields 0, then accesses value[len - 1]. Since len is gsize(unsigned), len - 1 wraps to SIZE_MAX, causing a read of 1 byte before the heap allocation (under-read). Any application that loads a key file from untrusted input and calls g_key_file_
Bugzilla
CVE-2026-58014 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
bugzilla·2026-06-24·CVSS 7.3
CVE-2026-58014 [HIGH] CVE-2026-58014 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
CVE-2026-58014 glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
A heap-buffer-overflow READ of 1 byte occurs in g_key_file_get_locale_string_list() at gkeyfile.c:2464 when the resolved locale string value is an empty string (""). The function computes len = strlen(value) which yields 0, then accesses value[len - 1]. Since len is gsize(unsigned), len - 1 wraps to SIZE_MAX, causing a read of 1 byte before the heap allocation (under-read). Any application that loads a key file from untrusted input and calls g_key_file_get_locale_string_list() on a key whose value is empty is affected. The key file format is commonly used for .desktop files and application configuration.
https://access.redhat.com/errata/RHSA-2026:49512https://access.redhat.com/errata/RHSA-2026:55440https://access.redhat.com/errata/RHSA-2026:57015https://access.redhat.com/errata/RHSA-2026:58981https://access.redhat.com/errata/RHSA-2026:61766https://access.redhat.com/errata/RHSA-2026:61783https://access.redhat.com/errata/RHSA-2026:63135https://access.redhat.com/errata/RHSA-2026:63138https://access.redhat.com/errata/RHSA-2026:63140https://access.redhat.com/errata/RHSA-2026:65762https://access.redhat.com/errata/RHSA-2026:65763https://access.redhat.com/errata/RHSA-2026:65767https://access.redhat.com/errata/RHSA-2026:65768https://access.redhat.com/errata/RHSA-2026:65769https://access.redhat.com/errata/RHSA-2026:65770https://access.redhat.com/errata/RHSA-2026:65771https://access.redhat.com/errata/RHSA-2026:65773https://access.redhat.com/errata/RHSA-2026:66018https://access.redhat.com/errata/RHSA-2026:66357https://access.redhat.com/errata/RHSA-2026:70586https://access.redhat.com/errata/RHSA-2026:70646https://access.redhat.com/errata/RHSA-2026:72394https://access.redhat.com/errata/RHSA-2026:72395https://access.redhat.com/errata/RHSA-2026:72399https://access.redhat.com/errata/RHSA-2026:72470https://access.redhat.com/errata/RHSA-2026:72475https://access.redhat.com/errata/RHSA-2026:72476https://access.redhat.com/errata/RHSA-2026:72502https://access.redhat.com/errata/RHSA-2026:73851https://access.redhat.com/errata/RHSA-2026:73859https://access.redhat.com/errata/RHSA-2026:73866https://access.redhat.com/errata/RHSA-2026:73909https://access.redhat.com/errata/RHSA-2026:73929https://access.redhat.com/errata/RHSA-2026:73930https://access.redhat.com/errata/RHSA-2026:73959https://access.redhat.com/errata/RHSA-2026:73960https://access.redhat.com/errata/RHSA-2026:73961https://access.redhat.com/errata/RHSA-2026:73962https://access.redhat.com/errata/RHSA-2026:74458https://access.redhat.com/errata/RHSA-2026:74459https://access.redhat.com/errata/RHSA-2026:74460https://access.redhat.com/errata/RHSA-2026:74461https://access.redhat.com/errata/RHSA-2026:74462https://access.redhat.com/errata/RHSA-2026:74463https://access.redhat.com/errata/RHSA-2026:74674https://access.redhat.com/errata/RHSA-2026:74677https://access.redhat.com/errata/RHSA-2026:74678https://access.redhat.com/errata/RHSA-2026:74679https://access.redhat.com/errata/RHSA-2026:74681https://access.redhat.com/errata/RHSA-2026:74683https://access.redhat.com/errata/RHSA-2026:74685https://access.redhat.com/errata/RHSA-2026:74687https://access.redhat.com/errata/RHSA-2026:74688https://access.redhat.com/errata/RHSA-2026:74771https://access.redhat.com/errata/RHSA-2026:75652https://access.redhat.com/errata/RHSA-2026:75654https://access.redhat.com/errata/RHSA-2026:75655https://access.redhat.com/errata/RHSA-2026:75657https://access.redhat.com/errata/RHSA-2026:75658https://access.redhat.com/errata/RHSA-2026:75659https://access.redhat.com/errata/RHSA-2026:75660https://access.redhat.com/errata/RHSA-2026:76042https://access.redhat.com/errata/RHSA-2026:77320https://access.redhat.com/errata/RHSA-2026:80769https://access.redhat.com/errata/RHSA-2026:80771https://access.redhat.com/errata/RHSA-2026:82059https://access.redhat.com/errata/RHSA-2026:82061https://access.redhat.com/errata/RHSA-2026:82066https://access.redhat.com/errata/RHSA-2026:82304https://access.redhat.com/errata/RHSA-2026:82322https://access.redhat.com/errata/RHSA-2026:82336https://access.redhat.com/errata/RHSA-2026:82347https://access.redhat.com/errata/RHSA-2026:82354https://access.redhat.com/errata/RHSA-2026:82368https://access.redhat.com/errata/RHSA-2026:82371https://access.redhat.com/errata/RHSA-2026:82372https://access.redhat.com/errata/RHSA-2026:82415https://access.redhat.com/errata/RHSA-2026:82811https://access.redhat.com/errata/RHSA-2026:82857https://access.redhat.com/errata/RHSA-2026:82888https://access.redhat.com/security/cve/CVE-2026-58014https://bugzilla.redhat.com/show_bug.cgi?id=2492255https://gitlab.gnome.org/GNOME/glib/-/issues/3930https://gitlab.gnome.org/GNOME/glib/-/issues/3930
2026-06-30
Published