CVE-2026-58011: Gnome Glib DoS Vulnerability

CVE-2026-58011 Overview

CVE-2026-58011 is an out-of-bounds read vulnerability [CWE-125] in GLib, the low-level core library used across the GNOME desktop environment and many Linux applications. The flaw resides in the g_date_time_get_ymd function in glib/gdatetime.c. When the function processes an invalid GDateTime object produced by g_date_time_add_full, it reads 2 bytes beyond the intended buffer boundary. The out-of-bounds access can corrupt date output and trigger logic errors that lead to a denial of service in dependent applications.

Critical Impact
Attackers can trigger application crashes and denial of service in any process that handles untrusted date arithmetic through GLib, including services built on Red Hat Enterprise Linux 6 through 10.

Affected Products

GNOME GLib (including version 2.88.0)
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Applications and services that call g_date_time_add_full on attacker-influenced inputs

Discovery Timeline

2026-06-30 - CVE-2026-58011 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58011

Vulnerability Analysis

GLib exposes the GDateTime API for calendar and time arithmetic. The g_date_time_add_full function accepts year, month, day, hour, minute, and second offsets and returns a new GDateTime. When callers supply extreme or malformed offsets, the function can construct a GDateTime object whose internal Julian representation falls outside the valid range supported by the library.

When a subsequent call to g_date_time_get_ymd normalizes that object into year, month, and day components, it indexes into internal lookup tables that map Julian days to calendar values. Because the input object is invalid, the index escapes the table bounds and the function reads 2 bytes past the allocated buffer. The affected process then returns corrupted year, month, or day values to the caller.

Root Cause

The root cause is missing validation of the intermediate GDateTime object before it is passed to lookup logic in g_date_time_get_ymd. The function trusts that any object produced by g_date_time_add_full falls within representable ranges. Overflow during the addition breaks that assumption and produces an out-of-bounds table index.

Attack Vector

The attack vector is network reachable when a target service accepts date or duration input from remote users. Common exposure paths include calendar servers, log processors, scheduling APIs, file metadata parsers, and any service that adds a user-controlled interval to a base timestamp. The attacker supplies boundary values that force g_date_time_add_full to return an invalid object. The subsequent read in g_date_time_get_ymd reads beyond the buffer and can crash the process, producing a denial of service. Confidentiality and integrity of application data are not directly affected, but corrupted date output can cascade into logic errors in dependent code.

The vulnerability requires no authentication and no user interaction. See the Red Hat CVE-2026-58011 Advisory and GNOME glib Issue #3917 for upstream analysis.

Detection Methods for CVE-2026-58011

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libglib-2.0, particularly during date parsing or arithmetic operations
Application logs showing malformed year, month, or day values returned from GLib-based components
Repeated restarts of services that process user-supplied timestamps or durations

Detection Strategies

Inventory installed GLib versions across Linux hosts using pkg-config --modversion glib-2.0 or the platform package manager and flag versions predating the vendor patch
Monitor AddressSanitizer or Valgrind output in test environments for out-of-bounds reads in g_date_time_get_ymd
Correlate application crash telemetry with process command lines that include GLib-linked binaries handling untrusted date fields

Monitoring Recommendations

Ingest crash dumps and systemd-coredump events into a central logging platform and alert on repeated faults in GLib-consuming services
Track outbound advisories from Red Hat and GNOME for updated GLib packages tied to CVE-2026-58011
Baseline normal date-field input ranges for exposed APIs and alert on values that exceed reasonable calendar arithmetic bounds

How to Mitigate CVE-2026-58011

Immediate Actions Required

Apply the GLib update from your Linux distribution as soon as it becomes available for Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Restart all long-running services that link against libglib-2.0 after patching to ensure the updated library is loaded
Audit application code that calls g_date_time_add_full with attacker-controlled offsets and add input range checks

Patch Information

Upstream tracking is available at GNOME glib Issue #3917 and GNOME glib Work Item #3917. Distribution-specific fixes are tracked in Red Hat Bug Report #2492245 and the Red Hat CVE-2026-58011 Advisory. Apply the patched GLib package once released for your Red Hat Enterprise Linux version.

Workarounds

Validate year, month, day, hour, minute, and second arguments before calling g_date_time_add_full and reject values outside the supported calendar range
Wrap calls to g_date_time_get_ymd in error-handling logic that discards output when input objects were produced from arithmetic on user-controlled offsets
Restrict network exposure of services that perform GLib-based date arithmetic on untrusted input until patches are deployed

bash

# Verify installed GLib version on Red Hat Enterprise Linux
rpm -q glib2

# Apply available security updates for GLib
sudo dnf update glib2

# Confirm the runtime library version after update
pkg-config --modversion glib-2.0