CVE-2026-1484: Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()
A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.
Other sources
Integer Overflow leads to Buffer Underflow vulnerability in GLib’s Base64 encoding implementation. The flaw is caused by storing the output length returned by gbase64encodestep() in a signed integer (gint). When encoding very large attacker-controlled input, this value may overflow and become negative. The resulting pointer arithmetic in gbase64encodeclose() leads to a buffer underflow and out-of-bounds heap write. Exploitation requires that an application passes untrusted or excessively large input to the Base64 encoding API and may result in application crashes or potential memory corruption.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1484?
CVE-2026-1484 has been classified with a high severity due to the potential for buffer underflow and out-of-bounds write.
How do I fix CVE-2026-1484?
To mitigate CVE-2026-1484, update GLib to the latest version where the vulnerability has been addressed.
What is the impact of CVE-2026-1484?
CVE-2026-1484 can lead to crashes or arbitrary code execution due to improper handling of large input data in the base64 encoding routine.
Which versions of GLib are affected by CVE-2026-1484?
CVE-2026-1484 affects various versions of the GLib library, particularly prior to patches that address this integer overflow issue.
Can CVE-2026-1484 be exploited remotely?
Yes, CVE-2026-1484 could potentially be exploited remotely if an application processes untrusted input utilizing the GLib library.