CVE-2026-58011 Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
An out-of-bounds read in GLib's date handling can cause logic errors and denial of service when processing invalid date objects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58011?
CVE-2026-58011 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2026-58011?
It affects 2 products.
Products include Gnome Glib, Redhat Enterprise Linux.
How do I fix CVE-2026-58011?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-58011 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58011 exists.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2020-35457 Integer overflow in n/a
- CVE-2009-3289 Privilege escalation in n/a
- CVE-2025-13601 Glib: integer overflow in in g_escape_uri_string()
- CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
- CVE-2025-4056 Glib: glib crash after long command line
Sources
Also known as AZL-91439, BELL-CVE-2026-58011, DEBIAN-CVE-2026-58011, ECHO-4f7c-c9ef-8a40, GHSA-8xmh-8wfg-9f6j, JLSEC-2026-1244 and 5 more.