GNOME GLib up to 2.86.4/2.88.0 gvariant-serialiser.c gvs_tuple_is_normal buffer over-read

Summaryinfo

A vulnerability was found in GNOME GLib up to 2.86.4/2.88.0 and classified as critical. This issue affects the function gvs_tuple_is_normal of the file glib/gvariant-serialiser.c. Such manipulation leads to buffer over-read. This vulnerability is referenced as CVE-2026-58010. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in GNOME GLib up to 2.86.4/2.88.0. It has been rated as critical. Affected by this issue is the function gvs_tuple_is_normal of the file glib/gvariant-serialiser.c. The manipulation with an unknown input leads to a buffer over-read vulnerability. Using CWE to declare the problem leads to CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. Impacted is confidentiality, and availability. CVE summarizes:

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-58010 since 06/26/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2.86.5 or 2.88.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• GNOME

Name

• GLib

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46
• 2.47
• 2.48
• 2.49
• 2.50
• 2.51
• 2.52
• 2.53
• 2.54
• 2.55
• 2.56
• 2.57
• 2.58
• 2.59
• 2.60
• 2.61
• 2.62
• 2.63
• 2.64
• 2.65
• 2.66
• 2.67
• 2.68
• 2.69
• 2.70
• 2.71
• 2.72
• 2.73
• 2.74
• 2.75
• 2.76
• 2.77
• 2.78
• 2.79
• 2.80
• 2.81
• 2.82
• 2.83
• 2.84
• 2.85
• 2.86
• 2.86.0
• 2.86.1
• 2.86.2
• 2.86.3
• 2.86.4
• 2.87
• 2.88.0

License

• open-source

Website

• Vendor: https://www.gnome.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion