CVE-2026-58010: Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
Other sources
Glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal()
— Microsoft
gvstupleisnormal() in glib/gvariant-serialiser.c:1253 has an off-by-one error in its alignment padding check. When checking whether padding bytes are zero, the bounds check uses > instead of >=, allowing a 1-byte out-of-bounds read when offset == value.size.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.78.6-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58010?
CVE-2026-58010 has a severity rating of high at 8.2.
What systems are affected by CVE-2026-58010?
CVE-2026-58010 affects Red Hat Enterprise Linux and Gnome GLib.
How do I fix CVE-2026-58010?
To fix CVE-2026-58010, update your GLib package to the latest version provided by your operating system vendor.
What type of vulnerability is CVE-2026-58010?
CVE-2026-58010 is a buffer over-read vulnerability that can lead to an out-of-bounds read.
What are the potential impacts of CVE-2026-58010?
CVE-2026-58010 may lead to minor information leakage due to the out-of-bounds read.