CVE-2026-58013: GLib Buffer Over-read in Line Terminator Parsing

Technical summary

CVE-2026-58013 exists in g_io_channel_read_line_backend() within giochannel.c. The flaw arises from insufficient bounds checking when a custom line terminator exceeds one byte in length. The memcmp() function is called without proper validation that the source buffer contains enough data, causing an out-of-bounds memory read. The vulnerability is classified under CWE-126 (Buffer Over-read). Impact depends on memory layout: minor information disclosure is possible when the read accesses readable adjacent memory, or a segmentation fault and denial of service when the read crosses a page boundary into unmapped memory.

Business impact

Organizations running applications that link GLib and accept input with custom multi-byte line terminators face dual risks: confidentiality loss from memory disclosure and availability loss from potential crashes. The practical business impact is moderate because exploiting this requires specific application configurations. However, if GLib is embedded in widely distributed software that processes untrusted input, the cumulative risk across many endpoints could be significant. Developers maintaining long-running services or data-processing pipelines should prioritize assessment to determine if their input handling triggers the flaw.

Affected systems

GLib itself is affected across versions prior to the patch. Red Hat Enterprise Linux distributions are explicitly listed as vulnerable platforms, indicating the library is bundled or packaged with multiple RHEL versions. Any application or service that statically or dynamically links GLib and calls g_io_channel_read_line() with a custom terminator is at risk. This includes data-processing tools, daemons, and network services that parse custom text formats.

Exploitability

Exploitation requires two conditions: the affected GLib code path must be reachable (input must be processed through g_io_channel_read_line_backend with a non-default terminator), and the input itself must trigger the over-read. The attack vector is network-accessible if a vulnerable service accepts remote input. The CVSS score of 6.5 reflects low complexity and no authentication requirements, but practical exploitation is constrained by the need for specific application configurations and the limited information disclosure window (7 bytes). Active exploitation in the wild is not confirmed, and this is not listed on the CISA KEV catalog.

Remediation

Update GLib to a patched version released by the maintainers. Red Hat customers should apply security updates for affected RHEL versions through their normal patch management channels. Verification of the exact patched version should be confirmed against Red Hat security advisories. Interim mitigation: review applications to determine whether they use custom line terminators in GLib I/O operations; if not, the risk surface is minimized. Developers can consider input validation to reject unusual terminators if feasible.

Patch guidance

Check Red Hat Security Advisories (RHSA) for the specific errata affecting your RHEL version(s). GLib updates are typically delivered through package managers (yum/dnf). After patching, validate that dependent applications restart cleanly and that parsing behavior remains consistent. Test with your normal input patterns to ensure no regression. If GLib is statically linked into applications, those applications must be rebuilt and redeployed with the patched library.

Detection guidance

Monitor system logs for segmentation faults or crashes in GLib-based processes, particularly those processing input with non-standard line endings. Network intrusion detection can look for unusual multi-byte sequences that might be crafted to trigger the over-read, though signature-based detection is limited without knowing the specific input patterns of your applications. Host-based endpoint detection may flag memory-access violations in GLib functions. Audit package repositories to confirm GLib versions in use and cross-reference against patch availability.

Why prioritize this

Medium CVSS score (6.5) reflects the network-accessible vector and lack of authentication requirements, but the vulnerability's real-world priority depends on your deployment. Organizations running data-processing services, message brokers, or network daemons that use GLib for input parsing should prioritize this within a standard patch cycle. Those with GLib deployments only in non-network-facing contexts can defer longer. The fact this is not on the CISA KEV list suggests active exploitation is not yet observed, reducing urgency relative to critical CVEs.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: network-accessible attack vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), low confidentiality impact (C:L) from information disclosure, no integrity impact (I:N), and low availability impact (A:L) from denial of service. The score appropriately captures a flaw that can leak small amounts of memory or crash a service, but does not allow arbitrary code execution or full system compromise. Real-world severity may vary based on whether your specific applications and deployment patterns trigger the vulnerable code path.

Frequently asked questions