CVE-2026-58010: GLib Off-by-One Bounds Check Vulnerability – Information Disclosure and DoS

Technical summary

CVE-2026-58010 stems from an off-by-one error in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c. The alignment padding validation uses a greater-than (>) comparison instead of greater-than-or-equal-to (>=) in its bounds check, permitting a single-byte out-of-bounds read. When this read straddles a page boundary, the kernel may raise a segmentation fault, resulting in denial of service. In other cases, the single byte read may disclose adjacent heap or stack data. The vulnerability is classified under CWE-126 (Buffer Over-read).

Business impact

Organizations running GLib-dependent applications face dual exposure: confidentiality risk from single-byte information leaks and availability risk from denial-of-service crashes. While a one-byte disclosure is modest in isolation, repeated exploitation or timing side-channels could accumulate information. The denial-of-service vector is more immediately problematic for services that deserialize untrusted GVariant data, potentially enabling attackers to interrupt service availability. Patching is moderately urgent but not critical given the severity profile.

Affected systems

GLib is a low-level C utility library used across GNOME and many Linux systems. The vulnerability affects GNOME GLib directly and propagates to Red Hat Enterprise Linux versions that bundle affected GLib releases. Any application or library using GLib's GVariant serialization—particularly those processing untrusted serialized data—may be vulnerable. Check your environment's GLib version and review which upstream or vendor patches are available.

Exploitability

Exploitation requires crafting a malicious GVariant-serialized message and delivering it to an application that deserializes it without sufficient validation. The attack vector is network-accessible in services that accept GVariant input over the network or via inter-process communication. However, no public exploit code or active in-the-wild exploitation has been documented. The barrier to crafting a proof-of-concept is low for researchers with access to GLib source code, but the practical impact per exploitation attempt is limited to one byte of data or a process crash.

Remediation

Apply vendor-supplied patches for GLib and affected distributions as they become available. Verify the specific patched GLib version and distribution release notes from Red Hat and GNOME project advisories. As an interim measure, restrict network access to services that deserialize untrusted GVariant data, and monitor application logs for segmentation faults or crashes that may indicate exploitation attempts. Application-level input validation should complement GLib updates.

Patch guidance

Check Red Hat Enterprise Linux security advisories and GNOME GLib release notes for patched versions addressing this off-by-one error. Apply patches through your standard patch management process, prioritizing systems that expose GVariant deserialization to untrusted input. Test patches in a staging environment before production deployment to ensure compatibility with your GLib-dependent applications. Verify the patch addresses the bounds check modification in gvariant-serialiser.c.

Detection guidance

Monitor system logs and application error streams for segmentation faults or crashes originating from glib or gvariant-related functions, which may indicate exploitation attempts targeting the page-boundary condition. Network-level detection is limited because the attack is payload-based; focus on anomalous deserialization errors or unexpected process terminations in GLib-using services. Endpoint detection and response (EDR) tools should flag repeated crashes in the same process or coordinated crashes across multiple instances.

Why prioritize this

CVE-2026-58010 merits prompt but not emergency patching. The CVSS score of 6.5 (MEDIUM) reflects the dual impact of information disclosure and denial of service, but the one-byte leak is confined and exploitability requires crafted input. Prioritize systems that process untrusted GVariant data from network sources or user-controlled interfaces. Organizations with strict availability requirements should treat the DoS vector as higher priority than those where occasional crashes are tolerable.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) is assigned because: (1) network accessibility (AV:N) and no privilege requirement (PR:N) lower the barrier to attack; (2) the information disclosure (C:L) is minimal at one byte but present; (3) the denial of service impact (A:L) is real but not total system compromise; (4) no integrity impact is possible (I:N). The score appropriately reflects a moderate security concern that should not be ignored but is not an emergency in most environments.

Frequently asked questions