State Confusion Flaw in GLib Affecting D-Bus Introspection
CVE-2026-58016

7.5HIGH

Key Information:

Vendor

Gnome
Status
Glib
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Vendor
CVE Published:
30 June 2026

What is CVE-2026-58016?

A state confusion issue has been identified in GLib, particularly in the function g_dbus_node_info_new_for_xml() found in gio/gdbusintrospection.c. This vulnerability arises when processing malformed D-Bus introspection XML with a element incorrectly nested within elements like , , , or . Such a misconfiguration can result in an unsigned integer overflow, potentially allowing for an out-of-bounds read, which may ultimately lead to a denial of service.

Affected Version(s)

GLib 0 < 2.88.1

References

https://access.redhat.com/security/cve/CVE-2026-58016
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492257
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/glib/-/issues/3932

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank linhlhq for reporting this issue.
.