CVE-2026-58014 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
An off-by-one error in GLib's key file parser allows out-of-bounds access, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58014?
CVE-2026-58014 is a high-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Weakness: CWE-193
Which versions are affected by CVE-2026-58014?
It affects 2 products.
Products include Gnome Glib, Redhat Enterprise Linux.
How do I fix CVE-2026-58014?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-58014 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58014 exists.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2020-35457 Integer overflow in n/a
- CVE-2009-3289 Privilege escalation in n/a
- CVE-2025-13601 Glib: integer overflow in in g_escape_uri_string()
- CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
- CVE-2025-4056 Glib: glib crash after long command line
Sources
Also known as AZL-91445, BELL-CVE-2026-58014, DEBIAN-CVE-2026-58014, ECHO-cd39-6531-4266, GHSA-h88q-m8mm-7243, JLSEC-2026-1247 and 5 more.