CVE-2026-16118: xdgmime Buffer Overflow Vulnerability

CVE-2026-16118 Overview

A heap-based buffer overflow vulnerability exists in xdgmime, the shared MIME database library used across Linux desktop environments. The flaw resides in the _xdg_mime_magic_parse_magic_line() function within xdgmimemagic.c. On little-endian systems, incorrect pointer arithmetic during a byte-swap operation causes an out-of-bounds write of two bytes. An attacker who can place a crafted MIME magic file in a user-writable XDG data location such as $XDG_DATA_HOME/mime/magic can trigger the flaw when any application performs MIME type detection through interfaces like g_content_type_guess(). The result is memory corruption or an application crash. This weakness is classified as [CWE-122] Heap-based Buffer Overflow.

Critical Impact
Local attackers can corrupt heap memory in any process performing MIME detection, enabling application crashes and potential code execution paths through library-wide reachability.

Affected Products

xdgmime shared MIME database library (freedesktop.org)
Applications using GLib g_content_type_guess() and related MIME detection APIs
Linux distributions bundling vulnerable xdgmime versions (see Red Hat advisory)

Discovery Timeline

2026-07-17 - CVE-2026-16118 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16118

Vulnerability Analysis

The vulnerability lives in _xdg_mime_magic_parse_magic_line(), the routine responsible for parsing entries in a MIME magic database file. Magic files describe byte patterns used to identify file types. Entries carry a value and a mask that the library compares against candidate file contents.

On little-endian systems, multi-byte values require a byte-swap so that on-disk big-endian magic entries match host memory representation. During this byte-swap step, the write side of the operation uses incorrect pointer arithmetic. The result is a two-byte write past the bounds of the allocated heap buffer holding the parsed magic entry.

Because MIME detection is invoked implicitly by file managers, document viewers, mail clients, and archive tools, the corrupted buffer can influence adjacent heap metadata or object pointers. The immediate observable impact is loss of integrity and availability for the calling process.

Root Cause

The root cause is unsafe pointer arithmetic on the destination address during endian conversion inside _xdg_mime_magic_parse_magic_line(). The write offset is computed relative to the wrong base, causing a two-byte store to fall outside the intended heap allocation. See the GitLab Work Item #41 and the Red Hat Bug Report #2501732 for upstream discussion.

Attack Vector

Exploitation requires the attacker to write a crafted magic file into a user-controlled XDG data directory, typically $XDG_DATA_HOME/mime/magic. The vulnerability then triggers when the victim runs any application that performs MIME type detection. User interaction is required to invoke a MIME-detecting operation, such as opening a folder in a file manager or dragging a file. The attack is local because the malicious magic file must exist on the target file system.

The vulnerability manifests during byte-swap handling of magic entries on little-endian architectures. Technical detail is available in the Red Hat CVE-2026-16118 advisory.

Detection Methods for CVE-2026-16118

Indicators of Compromise

Presence of unexpected or recently modified files at $XDG_DATA_HOME/mime/magic or ~/.local/share/mime/magic for non-administrative users.
Unexplained crashes of GLib-based applications (nautilus, nemo, thunar, evince, gedit) with SIGABRT or SIGSEGV in libxdgmime or gio frames.
Core dumps referencing _xdg_mime_magic_parse_magic_line in the stack trace.

Detection Strategies

Monitor file creation and modification events under user-writable XDG MIME directories using auditd or file integrity monitoring.
Compare deployed xdgmime and shared-mime-info package versions against fixed versions published by the distribution vendor.
Alert on process crash telemetry that references the xdgmime library across desktop endpoints.

Monitoring Recommendations

Ingest auditd PATH and SYSCALL events for writes to ~/.local/share/mime/ into a centralized log platform.
Track ABRT, systemd-coredump, and apport reports naming the xdgmime component.
Baseline the population of magic files across managed Linux hosts and flag deviations.

How to Mitigate CVE-2026-16118

Immediate Actions Required

Apply distribution updates for xdgmime and shared-mime-info as soon as vendor patches are released.
Audit user home directories for unauthorized files under ~/.local/share/mime/magic and remove any that are not vendor-supplied.
Restrict write permissions on XDG data directories where feasible in multi-user or kiosk environments.

Patch Information

At time of publication, the upstream fix is tracked in GitLab Work Item #41. Downstream status for Red Hat Enterprise Linux is available in the Red Hat CVE-2026-16118 advisory. Consult your Linux distribution's security tracker for the specific package version that includes the corrected pointer arithmetic in _xdg_mime_magic_parse_magic_line().

Workarounds

Unset or point $XDG_DATA_HOME to a read-only location on hardened systems until patches are applied.
Remove or empty ~/.local/share/mime/magic and force applications to rely on the system-wide MIME database in /usr/share/mime/.
Enforce mandatory access controls (SELinux, AppArmor) that deny untrusted processes write access to XDG MIME directories.

bash

# Remove attacker-controlled user MIME magic file and refresh the system database
rm -f "${XDG_DATA_HOME:-$HOME/.local/share}/mime/magic"
update-mime-database "${XDG_DATA_HOME:-$HOME/.local/share}/mime"

# Optional hardening: make the user MIME directory immutable
chattr +i "${XDG_DATA_HOME:-$HOME/.local/share}/mime"