CVE-2026-58011: GLib Out-of-Bounds Read in Date-Time Handling (CVSS 6.5)

Technical summary

CVE-2026-58011 is an out-of-bounds read (CWE-125) in GLib's g_date_time_get_ymd function. The vulnerability occurs when g_date_time_add_full generates an invalid GDateTime object that is subsequently processed by g_date_time_get_ymd. The 2-byte read exceeds allocated bounds in gdatetime.c, potentially corrupting the extracted year-month-day values and triggering application logic errors or crashes. The CVSS 3.1 score of 6.5 (MEDIUM, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects network-accessible exploitation, low attack complexity, no privilege requirement, and impact to both integrity and availability.

Business impact

Organizations running applications built on affected GLib versions face risk of date-calculation errors leading to incorrect business logic execution or service unavailability. Critical date-dependent processes—such as scheduling, event processing, or timestamp validation—may malfunction silently or crash. Unlike a vulnerability with confidentiality impact, this flaw primarily threatens service reliability and data consistency rather than data exposure.

Affected systems

This vulnerability affects GLib and systems running Red Hat Enterprise Linux distributions that bundle or depend on vulnerable GLib versions. Any application linking against affected GLib libraries is potentially at risk, particularly those that perform date arithmetic or manipulation via the g_date_time_add_full and g_date_time_get_ymd functions. Verify your specific GLib and RHEL versions against vendor advisories to confirm exposure.

Exploitability

The vulnerability requires no authentication and can be triggered remotely by supplying specially crafted date-time input to an application using GLib. Attack complexity is low; an attacker needs only to induce the application to process an invalid GDateTime object generated by g_date_time_add_full. The flaw is not listed on CISA's Known Exploited Vulnerabilities catalog, indicating no documented active exploitation at publication time. However, the straightforward attack surface and network accessibility make it suitable for weaponization if not patched promptly.

Remediation

Apply security updates from the GLib project and Red Hat for affected RHEL versions. Patch availability and version numbers are published in vendor advisories; consult the official Red Hat Security Advisory and GLib release notes for your specific platform. Organizations unable to patch immediately should restrict network access to affected applications or disable date-manipulation features if feasible.

Patch guidance

Consult Red Hat Security Advisories and the GLib project releases for definitive patch versions. Typically, GLib maintains a stable release branch with security fixes. Test patches in non-production environments first, as date-handling changes may affect application behavior. Verify patch application by confirming the GLib version via pkg-config or your package manager, and validate that date-arithmetic operations behave correctly in your use cases.

Detection guidance

Monitor application logs for unusual date values, parsing errors, or crashes originating from GLib date-time functions. Network-based detection is challenging without instrumentation; focus on host-level signals such as segmentation faults or application restarts correlated with date-processing requests. Consider adding defensive checks in critical code paths to validate GDateTime objects before processing, or enable sanitizer builds (ASAN/UBSAN) in testing to catch out-of-bounds reads earlier in development.

Why prioritize this

Although MEDIUM-severity, this flaw warrants timely attention because it affects a foundational library (GLib) widely used across Linux ecosystems, carries no authentication barrier, and is network-accessible. The integrity and availability impact can disrupt service reliability. Prioritize patching for systems that perform date-sensitive operations (finance, scheduling, logging) or that are internet-facing. Systems with offline or restricted-network deployments can be deprioritized slightly.

Risk score, explained

CVSS 3.1 score of 6.5 reflects the moderate threat profile: network accessibility and low attack complexity elevate risk, but the absence of confidentiality impact and limited severity of integrity/availability effects prevent a higher rating. The flaw does not grant unauthorized access or compromise secrets, reducing criticality compared to high-severity remote code execution flaws. However, the widespread presence of GLib in production systems and the ease of exploitation justify serious remediation efforts.

Frequently asked questions