CVE-2026-58016: Gnome Glib DOS Vulnerability

CVE-2026-58016 Overview

A flaw exists in GNOME GLib within the g_dbus_node_info_new_for_xml() function in gio/gdbusintrospection.c. The function fails to correctly handle malformed D-Bus introspection XML when a <node> element is nested inside other elements such as <method>, <signal>, <property>, or <arg>. This state confusion triggers an unsigned integer underflow [CWE-191], which produces an out-of-bounds read and crashes the consuming process. The issue affects GNOME GLib and multiple Red Hat Enterprise Linux releases that ship the library.

Critical Impact
Remote attackers can crash any process that parses attacker-supplied D-Bus introspection XML through GLib, causing denial of service across desktop and system services that depend on GDBus.

Affected Products

GNOME GLib
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Applications and system services linking against vulnerable GLib builds

Discovery Timeline

2026-06-30 - CVE-2026-58016 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58016

Vulnerability Analysis

GLib provides the GDBus library used by GNOME and many Linux system services to communicate over D-Bus. Applications call g_dbus_node_info_new_for_xml() to parse D-Bus introspection XML that describes objects, interfaces, methods, signals, and properties. The parser tracks nesting state as it walks the XML tree. When a <node> element appears inside <method>, <signal>, <property>, or <arg>, the parser reaches an unexpected state and its internal counters desynchronize from the actual element stack. This state confusion is classified under [CWE-191] as an integer underflow condition.

Root Cause

The parser decrements an unsigned counter tracking element depth without verifying that the counter is greater than zero. Malformed nesting drives the counter below zero, and the unsigned type wraps to a very large value. Subsequent indexing into the associated buffer uses this wrapped value and reads memory well outside the intended object, terminating the process with a segmentation fault.

Attack Vector

Any code path that feeds untrusted XML into g_dbus_node_info_new_for_xml() is exposed. Attackers who can send D-Bus introspection payloads to a targeted service, or who can supply a crafted XML file to a tool that parses it, can trigger the fault. Because D-Bus is widely used for privileged system services, a crash can disable authentication agents, network managers, or session infrastructure. No authentication or user interaction is required when the parsing service accepts remote or unprivileged input.

The vulnerability is a parser state machine defect. No verified public exploit code is available. See the GNOME GLib Issue #3932 and the Red Hat CVE-2026-58016 Advisory for the upstream discussion and patch details.

Detection Methods for CVE-2026-58016

Indicators of Compromise

Repeated crashes or segmentation faults in processes linked against libgio-2.0 or libglib-2.0, particularly system services that expose D-Bus interfaces.
journalctl or coredumpctl entries showing termination inside g_dbus_node_info_new_for_xml or nearby GDBus introspection frames.
D-Bus introspection XML payloads containing a <node> element nested inside <method>, <signal>, <property>, or <arg>.

Detection Strategies

Inspect D-Bus traffic with dbus-monitor or busctl capture for introspection responses that contain illegal <node> nesting.
Enable AddressSanitizer or Valgrind on non-production builds to surface out-of-bounds reads inside GDBus during fuzzing or QA.
Correlate service restarts of GDBus-consuming daemons against inbound D-Bus method calls to identify probing behavior.

Monitoring Recommendations

Track the installed GLib package version across the fleet and alert when hosts remain on unpatched builds.
Forward systemd-coredump events to a central log store and alert on repeat crashes of the same service.
Monitor for new local users, container workloads, or network peers issuing D-Bus introspection requests to privileged services.

How to Mitigate CVE-2026-58016

Immediate Actions Required

Apply the vendor GLib update to every host as soon as the packaged fix is available from the distribution.
Restart all long-running services that link against GLib after patching so the new library is loaded into memory.
Inventory applications that call g_dbus_node_info_new_for_xml() on untrusted XML and prioritize their update.

Patch Information

Red Hat is tracking the issue under Red Hat Bug Report #2492257 and the Red Hat CVE-2026-58016 Advisory. The upstream fix is discussed in GNOME GLib Issue #3932. Install the patched glib2 package from your Linux distribution and rebuild any statically linked binaries that bundle GLib.

Workarounds

Restrict D-Bus introspection to trusted peers by tightening busconfig policy files in /etc/dbus-1/system.d/.
Validate or reject D-Bus introspection XML at the application layer before passing it to g_dbus_node_info_new_for_xml().
Run affected services under systemd with Restart=on-failure to limit availability impact until the patch is deployed.

bash

# Configuration example
# Update GLib on Red Hat Enterprise Linux
sudo dnf update glib2

# Identify processes still using the pre-patch library
sudo lsof | grep -E 'libglib-2\.0|libgio-2\.0' | awk '{print $1, $2}' | sort -u

# Restart affected services after patching
sudo systemctl daemon-reexec
sudo systemctl restart dbus.service