RHSA-2026:97163: Moderate: mingw-glib2 security, bug fix, and enhancement update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.Security Fix(es): glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal() (CVE-2026-58010) glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd via invalid GDateTime (CVE-2026-58011) glib: buffer over-read in gregexreplace() via glib/gregex.c:stringappend() and gutf8nextchar() (CVE-2026-58012) glib: buffer over-read in glib/giochannel.c via "giochannelreadlinebackend" (CVE-2026-58013) glib: off-by-one error in glib/gkeyfile.c via "gkeyfilegetlocalestringlist" (CVE-2026-58014) glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyringlookupentry and mechanismclientdatareceive (CVE-2026-58015) glib: integer underflow in gio/gdbusintrospection.c via "gdbusnodeinfonewforxml" (CVE-2026-58016) Bug Fix(es) and Enhancement(s): [mingw-glib2] cause qga command 'guest-ssh-get-authorized-keys' failed (JIRA:RHEL-151748) Rebase mingw-glib2 to 2.87.5 (JIRA:RHEL-159874) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mingw-glib2to a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
redhat/mingw32-glib2to a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
redhat/mingw32-glib2-debuginfoto a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
redhat/mingw32-glib2-staticto a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
redhat/mingw64-glib2to a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
redhat/mingw64-glib2-debuginfoto a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
redhat/mingw64-glib2-staticto a version that resolves this vulnerability.Fixed in 2.89.2-1.el10 - Upgrade
Upgrade
mingw-glib2to a version that resolves this vulnerability.Fixed in 2.87.5