CVE-2026-58014: GLib Off-by-One Error in Key File Parsing (CVSS 7.3)

Technical summary

CVE-2026-58014 is an off-by-one error in the g_key_file_get_locale_string_list function within gkeyfile.c (GLib). When parsing a key file containing an empty value, the function miscalculates buffer boundaries, allowing a single-byte out-of-bounds read. If this access crosses a memory page boundary, the kernel may terminate the process, resulting in denial of service. In other cases, the read may expose adjacent heap memory. The vulnerability is classified as CWE-193 (Off-by-one Error) and carries a CVSS 3.1 score of 7.3 (HIGH) with network accessibility, no authentication required, and potential impact to confidentiality, integrity, and availability.

Business impact

GLib is a foundational library used across Linux distributions, GNOME desktop environments, and numerous applications for data structure manipulation and system utilities. Exploitation could disrupt services that rely on GLib for configuration parsing or cause information leakage from memory. While denial of service is the primary risk when page boundaries are crossed, the confidentiality impact means sensitive data in adjacent memory regions could be exposed. Organizations dependent on GNOME/Red Hat ecosystems should prioritize assessment to understand if their deployed services parse untrusted key files.

Affected systems

The vulnerability affects GLib across multiple Red Hat Enterprise Linux versions. Any application statically or dynamically linked against vulnerable GLib versions that calls g_key_file_get_locale_string_list or uses key file parsing on untrusted input is exposed. This includes configuration management tools, system services, and desktop applications. Organizations should inventory GLib versions in their environment and identify which processes parse external or user-supplied key files.

Exploitability

Exploitation requires delivery of a malformed key file with an empty value to an application that uses the vulnerable GLib function. No user interaction, authentication, or special privileges are needed. The attack surface depends on whether the target application accepts key files from network sources, user uploads, or other untrusted channels. Automated tooling could craft such files, but practical exploitation scenarios depend on the specific application's parsing behavior and memory layout.

Remediation

Apply GLib security updates provided by your distribution vendor as soon as they are available. For Red Hat Enterprise Linux users, check your RHEL version and install the patched GLib package from official repositories. Systems that do not parse key files from untrusted sources face reduced risk. Temporarily, restrict access to applications that process key files if update timelines are extended. Verify patches against the official vendor advisory before deployment.

Patch guidance

Contact your Linux distribution vendor or check official security advisories for GLib updates addressing CVE-2026-58014. Red Hat Enterprise Linux users should use their respective package management tools (yum, dnf) to update the glib2 package once patches are released. For GNOME and other downstream projects, follow their security update channels. Test patches in non-production environments to confirm compatibility with your applications before production rollout.

Detection guidance

Monitor for segmentation faults, out-of-memory conditions, or unexpected process terminations in applications that use GLib's key file parsing functionality. Review application logs for errors related to gkeyfile operations. Network-based detection is difficult; focus on endpoint monitoring for crashes in known-vulnerable GLib processes. Vulnerability scanners that identify GLib versions can help inventory affected systems. Log analysis for repeated key file parsing failures may indicate exploitation attempts.

Why prioritize this

GLib is ubiquitous in Linux environments and the CVSS score of 7.3 reflects meaningful risk across confidentiality, integrity, and availability. The network-accessible attack vector and lack of authentication requirements elevate concern. While the vulnerability does not appear on the CISA KEV list, the broad distribution of GLib and potential for denial of service make timely patching important for operational stability. Prioritize based on whether your organization's services accept key files from untrusted sources.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects network accessibility (AV:N), low attack complexity (AC:L), no authentication (PR:N), scope unchanged (S:U), and low impact to all three security properties (C:L, I:L, A:L). While individual impact metrics are rated low, the combination of easy exploitability and the potential for information disclosure or service disruption across multiple organizations using GLib justifies the HIGH severity classification. The score appropriately emphasizes the ease of triggering the vulnerability rather than maximum possible harm.

Frequently asked questions