Is CVE-2026-1489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1489 being exploited in the wild.

How severe is CVE-2026-1489?

Medium severity, with a CVSS score of 5.4, published 27 January 2026.

Which products and versions are affected?

Gnome Glib unspecified; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

Is there a fix for CVE-2026-1489?

A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 to address the issue in affected industrial products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1489 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1489?

Check whether you run Gnome Glib, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1489: GNOME GLib integer overflow in Unicode case conversion

CVE-2026-1489 · Severity: medium · CVSS 5.4 · Published 2026-01-27

A security flaw has been identified in GLib, a widely used software library that helps applications handle text and data. The issue occurs when the library processes extremely large or specially formatted text strings, which can cause the application to crash or behave unpredictably. This could potentially be used by an attacker to disrupt services or cause system instability in any software that relies on GLib for text conversion.

Technologies: Gnome Glib, Siemens RUGGEDCOM RST2428P, Siemens SINEC OS. Vendors: Gnome, Siemens.

Quick answers

Is CVE-2026-1489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1489 being exploited in the wild.
How severe is CVE-2026-1489?: Medium severity, with a CVSS score of 5.4, published 27 January 2026.
Which products and versions are affected?: Gnome Glib unspecified; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.
Is there a fix for CVE-2026-1489?: A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 to address the issue in affected industrial products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1489 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1489?: Check whether you run Gnome Glib, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in GLib's Unicode case conversion implementation within `glib/guniprop.c`. The flaw is rooted in the `output_marks()` and `real_tolower()` functions, where signed and unsigned integer types are mixed during the calculation of output buffer lengths. When an application calls `g_utf8_strup()` (and potentially `g_utf8_strdown()`) on gigabyte-scale attacker-supplied Unicode text, the overflow results in an undersized heap allocation. Subsequent UTF-8 character conversion via `g_unichar_to_utf8()` then performs out-of-bounds writes. While the attack requires the processing of extremely large strings, it can lead to memory corruption or a denial-of-service (crash). Siemens has addressed this in SINEC OS V4.0.

Affected products

GNOME GLib unspecified
Siemens SINEC OS before V4.0
Siemens RUGGEDCOM RST2428P before V4.0

Timeline

2025-12-16: disclosed: Reported via YesWeHack
2026-01-27: advisory: Initial CVE publication
2026-06-02: patched: Siemens released SINEC OS V4.0 to address the issue in affected industrial products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.