CVE-2026-58010: Gnome Glib Information Disclosure Flaw

CVE-2026-58010 Overview

CVE-2026-58010 is an off-by-one error in GLib, the low-level core library used by GNOME and many Linux applications. The flaw resides in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c. An alignment padding check uses > instead of >=, allowing a 1-byte out-of-bounds read [CWE-126]. The condition can leak a single byte of adjacent memory and can trigger a denial-of-service crash when the read crosses a page boundary. Affected products include GNOME GLib and multiple versions of Red Hat Enterprise Linux. The vulnerability is exploitable over the network without authentication or user interaction.

Critical Impact
A remote attacker can trigger a 1-byte out-of-bounds read in any application processing untrusted GVariant data, causing information disclosure or process crash when the read touches an unmapped page.

Affected Products

GNOME GLib (including version 2.88.0)
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Applications and services linking against vulnerable GLib builds and processing external GVariant data

Discovery Timeline

2026-06-30 - CVE-2026-58010 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58010

Vulnerability Analysis

GLib's GVariant serializer parses structured binary data used across GNOME, D-Bus, and many Linux services. The gvs_tuple_is_normal function verifies that a serialized tuple is in normal form before further processing. As part of that check, it validates alignment padding bytes against the end of the buffer. The bounds comparison incorrectly uses a strict greater-than operator, treating the byte at offset == buffer_end as still in range. When the function then reads that padding byte, it accesses memory one byte past the end of the allocation.

The read is limited to a single byte, so the resulting information disclosure is minimal. However, when the allocation ends exactly on a page boundary and the adjacent page is not mapped, the read faults and terminates the process. Services that parse attacker-controlled GVariant messages, such as D-Bus daemons and desktop components, are the primary exposure surface.

Root Cause

The root cause is an off-by-one bounds check in gvs_tuple_is_normal in glib/gvariant-serialiser.c. The code uses > where >= is required, so an offset equal to the buffer length is accepted as valid and dereferenced. This is a classic buffer over-read pattern classified under [CWE-126].

Attack Vector

An attacker delivers a crafted GVariant-serialized tuple to any process that parses it via GLib. Delivery paths include D-Bus messages, GSettings values, GDBus method arguments, and other IPC formats that carry GVariant payloads. No authentication or user interaction is required when the receiving service accepts messages from unprivileged local peers or network-facing endpoints. Successful triggering yields either a 1-byte read of adjacent heap memory or an abort of the target process.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. See the GNOME GLib Issue #3915 for upstream technical details.

Detection Methods for CVE-2026-58010

Indicators of Compromise

Unexpected SIGSEGV or SIGBUS crashes in processes linking libglib-2.0 while parsing GVariant or D-Bus data
Coredumps referencing gvs_tuple_is_normal or gvariant-serialiser.c in the fault backtrace
Repeated malformed D-Bus messages or GVariant payloads originating from a single peer or network source

Detection Strategies

Inventory installed GLib versions across Linux hosts and flag builds that predate the upstream fix referenced in the Red Hat CVE-2026-58010 advisory
Enable ABRT, systemd-coredump, or equivalent crash collection to capture faults in GLib-linked services and forward them to a centralized log store
Fuzz internal services that accept GVariant input with malformed tuples containing boundary-aligned padding to reproduce the fault pattern

Monitoring Recommendations

Alert on repeated service restarts of D-Bus, GNOME components, or other GLib consumers within short time windows
Monitor auditd for anom_abend events tied to GLib-linked binaries
Track vendor advisories such as the Red Hat Bug Report #2492243 for updated fixed package versions

How to Mitigate CVE-2026-58010

Immediate Actions Required

Apply vendor-supplied GLib updates as soon as they are published for your distribution
Restart all long-running services that link GLib after patching to ensure the fixed library is loaded
Restrict network exposure of services that parse untrusted GVariant or D-Bus data until patches are deployed
Enable core dump collection so that any exploitation attempt produces actionable forensic artifacts

Patch Information

The upstream fix corrects the bounds check in gvs_tuple_is_normal within glib/gvariant-serialiser.c by replacing the > comparison with >=. Track fixed package versions through the Red Hat CVE-2026-58010 advisory and the GNOME GLib Issue #3915. Rebuild statically linked applications that bundle GLib against a patched version.

Workarounds

Where patching is not immediately possible, restrict D-Bus and IPC endpoints to trusted local users using policy files in /etc/dbus-1/system.d/
Disable or firewall network-reachable services that expose GVariant parsing to remote peers
Run GLib-linked network services under process supervisors that limit restart storms and contain crash impact

bash

# Configuration example: verify installed GLib version and apply updates
rpm -q glib2
dnf update glib2
systemctl restart dbus