Executive brief
A security flaw has been identified in GLib, a widely used software library that helps applications handle text and data. The issue occurs when the library processes extremely large or specially formatted text strings, which can cause the application to crash or behave unpredictably. This could potentially be used by an attacker to disrupt services or cause system instability in any software that relies on GLib for text conversion.
Technical details
An integer overflow vulnerability exists in GLib's Unicode case conversion implementation within `glib/guniprop.c`. The flaw is rooted in the `output_marks()` and `real_tolower()` functions, where signed and unsigned integer types are mixed during the calculation of output buffer lengths. When an application calls `g_utf8_strup()` (and potentially `g_utf8_strdown()`) on gigabyte-scale attacker-supplied Unicode text, the overflow results in an undersized heap allocation. Subsequent UTF-8 character conversion via `g_unichar_to_utf8()` then performs out-of-bounds writes. While the attack requires the processing of extremely large strings, it can lead to memory corruption or a denial-of-service (crash). Siemens has addressed this in SINEC OS V4.0.
Affected products
- GNOME GLib unspecified
- Siemens SINEC OS before V4.0
- Siemens RUGGEDCOM RST2428P before V4.0
Timeline
- 2025-12-16: disclosed: Reported via YesWeHack
- 2026-01-27: advisory: Initial CVE publication
- 2026-06-02: patched: Siemens released SINEC OS V4.0 to address the issue in affected industrial products