By vendor

Gnome vulnerabilities

Known CVEs affecting Gnome products, prioritized by severity, with SEC.co remediation and detection guidance.

12 published vulnerabilities

• CVE-2026-58016HIGH 7.5

  GLib, a core utility library used across GNOME, Linux distributions, and many applications, contains a vulnerability in how it parses D-Bus introspection XML files. When specially malformed XML is processed—specifically when a `node` element is incorrectly nested inside method, signal, property, or argument definitions—the parsing code can become confused about its internal state. This confusion leads to an integer overflow in a counter, causing the parser to attempt reading from invalid memory locations. An attacker can exploit this by sending a malicious D-Bus introspection XML document, triggering a crash in any service that relies on GLib's D-Bus parsing. The impact is denial of service; no data theft or system compromise occurs.

• CVE-2026-58014HIGH 7.3

  A bug in GLib's key file parsing function can cause the application to read one byte beyond allocated memory when processing key files with empty values. This memory access violation may leak sensitive information, corrupt data, or crash the application. The vulnerability requires no user interaction and can be exploited over the network against systems that use the affected GLib versions to parse untrusted configuration or data files.

• CVE-2026-13601HIGH 7.1

  Yelp, a GNOME help viewer, contains a flaw in how it handles security policies that allow malicious applications running in a Flatpak sandbox to access files they shouldn't. By crafting specially formatted help content containing untrusted stylesheets embedded in SVG documents, an attacker can trick Yelp into reading arbitrary files from the host system and sending that data back over the internet. This bypasses Flatpak's sandbox protections, potentially exposing sensitive user data.

• CVE-2026-58010MEDIUM 6.5

  A flaw in GLib's variant serialization code contains an off-by-one error in boundary checking that allows reading one byte beyond intended memory limits. This can leak a small amount of sensitive data or crash applications when the out-of-bounds access crosses memory page boundaries. The vulnerability affects GLib across multiple Linux distributions and requires network access to exploit in most deployment scenarios.

• CVE-2026-58011MEDIUM 6.5

  A bug in GLib's date-time handling can cause an out-of-bounds memory read when processing malformed date objects. This flaw corrupts date calculations and may trigger denial-of-service conditions. The vulnerability requires no authentication and can be triggered remotely, making it moderately serious for systems that parse or manipulate dates via affected GLib versions.

• CVE-2026-58012MEDIUM 6.5

  GLib contains a buffer over-read vulnerability in its regex replacement function that occurs when specific compilation flags and string handling options interact. When the `g_regex_replace` function processes matched text with the `G_REGEX_RAW` flag enabled and case-change escape sequences, it attempts to interpret raw byte data as valid UTF-8, leading to reading beyond allocated buffer boundaries. The vulnerability can leak a small amount of adjacent memory and trigger application crashes if the overread crosses memory page boundaries, making it a moderate risk to availability and confidentiality.

• CVE-2026-58013MEDIUM 6.5

  GLib contains a buffer over-read vulnerability in its I/O channel line-reading function. When an application uses a custom line terminator longer than one character, the vulnerable code reads beyond the intended buffer boundary. This can leak a small amount of memory or crash the application if the read extends into unmapped memory. The issue is triggered when parsing input with unusual line terminators, which may or may not be common in typical deployments.

• CVE-2026-58015MEDIUM 5.9

  A security flaw in GLib's D-Bus SASL authentication allows a malicious D-Bus server to trick a client into reading arbitrary files from the system. During the DBUS_COOKIE_SHA1 authentication handshake, the server sends a cookie context parameter that the client does not properly validate. An attacker can embed path traversal sequences in this parameter to force the client to read sensitive files and leak their contents by comparing file data against cryptographic hashes. The attack requires network access and some guessing, but succeeds without user interaction.

• CVE-2026-1764MEDIUM 5.6

  GNOME localsearch, a desktop search indexing tool, contains a memory safety flaw in its MP3 metadata parser. When a specially crafted MP3 file with ID3v2.4 tags is processed, the software fails to properly validate tag boundaries before reading heap memory. This can crash the indexing process or leak sensitive data from the application's memory space. The vulnerability requires local access and user interaction—a user must open or index a malicious MP3 file—but the consequences can include service disruption and unintended data exposure.

• CVE-2026-1766MEDIUM 5.6

  A heap buffer overflow vulnerability exists in GNOME localsearch's MP3 file parser. When processing maliciously crafted MP3 files with corrupted ID3v2.3 comment tags, the tracker-extract-mp3 component can crash or leak sensitive data from system memory. An attacker needs local access and user interaction (opening or processing the file) to trigger the flaw. This is a moderate-risk issue affecting Linux systems running affected GNOME versions.

• CVE-2026-1767MEDIUM 5.6

  GNOME's localsearch application contains a heap buffer overflow flaw in its MP3 file processor that can be triggered when a specially crafted MP3 file with malformed ID3 tags is scanned or indexed. An attacker who can place a malicious MP3 on a system would cause the application to crash (denial of service) or potentially leak sensitive information from memory. This is not a remote code execution vulnerability and requires local access and user interaction to exploit.

• CVE-2026-12549MEDIUM 4.8

  A regression in HTTP Range request handling allows clients to craft requests that bypass security checks, resulting in malformed responses and potential service disruption. When a Range request specifies a suffix length larger than the content being served, the code fails to properly validate the resulting negative offset, leading to incorrect HTTP 206 Partial Content responses and excessive logging that can consume resources.