CVE-2026-0988: Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()
A flaw was found in glib. Missing validation of offset and count parameters in the gbufferedinputstreampeek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).
Other sources
Integer Overflow vulnerability in the gbufferedinputstreampeek() function of the GLib library. The issue is caused by missing validation of the offset and count parameters, leading to an unsafe arithmetic operation during length calculation. When specially crafted values are provided, the offset + count computation may overflow, resulting in an incorrect size being passed to memcpy(). This can trigger a heap or stack buffer overflow and lead to a segmentation fault. Exploitation is subject to strict preconditions and primarily impacts availability by causing application crashes.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0988?
CVE-2026-0988 has a high severity rating due to its potential to cause denial of service through an integer overflow.
How do I fix CVE-2026-0988?
To mitigate CVE-2026-0988, update to the latest version of glib where the vulnerable function g_buffered_input_stream_peek() is patched.
What software versions are affected by CVE-2026-0988?
CVE-2026-0988 affects glib but specific affected versions may vary, so it's important to check the details from the vendor.
What does CVE-2026-0988 exploit?
CVE-2026-0988 exploits missing validation in the g_buffered_input_stream_peek() function, causing an integer overflow during length calculation.
What are the potential impacts of CVE-2026-0988?
The potential impacts of CVE-2026-0988 include application crashes and denial of service, disrupting normal operation.