CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
An attacker can cause a denial of service in applications using GLib by sending malformed D-Bus introspection XML that triggers an integer underflow and out-of-bounds read.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58016?
CVE-2026-58016 is a high-severity vulnerability in Redhat Enterprise Linux, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
Weakness: CWE-191
Which versions are affected by CVE-2026-58016?
It affects 14 products.
Linux distribution packages (40)
glib2 AlmaLinux:10 | All versions | 2.80.4-12.el10_2.14 |
glib2-devel AlmaLinux:10 | All versions | 2.80.4-12.el10_2.14 |
glib2-doc AlmaLinux:10 | All versions | 2.80.4-12.el10_2.14 |
glib2-static AlmaLinux:10 | All versions | 2.80.4-12.el10_2.14 |
glib2-tests AlmaLinux:10 | All versions | 2.80.4-12.el10_2.14 |
glib2 AlmaLinux:8 | All versions | 2.56.4-170.el8_10 |
glib2-devel AlmaLinux:8 | All versions | 2.56.4-170.el8_10 |
glib2-doc AlmaLinux:8 | All versions | 2.56.4-170.el8_10 |
glib2-fam AlmaLinux:8 | All versions | 2.56.4-170.el8_10 |
glib2-static AlmaLinux:8 | All versions | 2.56.4-170.el8_10 |
glib2-tests AlmaLinux:8 | All versions | 2.56.4-170.el8_10 |
glib2 AlmaLinux:9 | All versions | 2.68.4-19.el9_8.2 |
glib2-devel AlmaLinux:9 | All versions | 2.68.4-19.el9_8.2 |
glib2-doc AlmaLinux:9 | All versions | 2.68.4-19.el9_8.2 |
glib2-static AlmaLinux:9 | All versions | 2.68.4-19.el9_8.2 |
glib2-tests AlmaLinux:9 | All versions | 2.68.4-19.el9_8.2 |
glib2 Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-devel Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-devel-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-doc Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-static Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-tests Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2-tests-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.80.4-12.el10_2.14 |
glib2 Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-devel-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-fam Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-fam-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-tests Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-tests-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-170.el8_10 |
glib2-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-170.el8_10 |
glib2-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-170.el8_10 |
glib2-devel-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-170.el8_10 |
glib2-doc Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-170.el8_10 |
glib2-fam-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-170.el8_10 |
glib2-static Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-170.el8_10 |
Products include Gnome Glib, Redhat Cert-Manager Operator, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder Eus, Redhat Discovery, Redhat Enterprise Linux and 8 more.
How do I fix CVE-2026-58016?
Apply the vendor's patch.
Is CVE-2026-58016 being exploited?
There is no known exploitation of CVE-2026-58016 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as ALSA-2026:42063, ALSA-2026:42089, ALSA-2026:42090, AZL-91433, BELL-CVE-2026-58016, CLSA-2026-1783432728 and 27 more.