# CVE-2026-1489: GNOME GLib integer overflow in Unicode case conversion

Source: https://junglewise.ai/threats/cve-2026-1489-gnome-glib-integer-overflow-in-unicode-case-conversion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-27. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-1489 · Severity: medium · CVSS 5.4 · Published 2026-01-27

A security flaw has been identified in GLib, a widely used software library that helps applications handle text and data. The issue occurs when the library processes extremely large or specially formatted text strings, which can cause the application to crash or behave unpredictably. This could potentially be used by an attacker to disrupt services or cause system instability in any software that relies on GLib for text conversion.

Technologies: [Gnome Glib](https://junglewise.ai/threats/technologies/glib), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p), [Siemens SINEC OS](https://junglewise.ai/threats/technologies/sinec-os). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-1489 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1489 being exploited in the wild.

**How severe is CVE-2026-1489?** Medium severity, with a CVSS score of 5.4, published 27 January 2026.

**Which products and versions are affected?** Gnome Glib unspecified; Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

**Is there a fix for CVE-2026-1489?** A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 to address the issue in affected industrial products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1489 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1489?** Check whether you run Gnome Glib, Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in GLib's Unicode case conversion implementation within `glib/guniprop.c`. The flaw is rooted in the `output_marks()` and `real_tolower()` functions, where signed and unsigned integer types are mixed during the calculation of output buffer lengths. When an application calls `g_utf8_strup()` (and potentially `g_utf8_strdown()`) on gigabyte-scale attacker-supplied Unicode text, the overflow results in an undersized heap allocation. Subsequent UTF-8 character conversion via `g_unichar_to_utf8()` then performs out-of-bounds writes. While the attack requires the processing of extremely large strings, it can lead to memory corruption or a denial-of-service (crash). Siemens has addressed this in SINEC OS V4.0.

## Affected products

- GNOME GLib unspecified
- Siemens SINEC OS before V4.0
- Siemens RUGGEDCOM RST2428P before V4.0

## Timeline

- 2025-12-16: disclosed: Reported via YesWeHack
- 2026-01-27: advisory: Initial CVE publication
- 2026-06-02: patched: Siemens released SINEC OS V4.0 to address the issue in affected industrial products

## References

- [https://access.redhat.com/security/cve/CVE-2026-1489](https://access.redhat.com/security/cve/CVE-2026-1489)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2433348](https://bugzilla.redhat.com/show_bug.cgi?id=2433348)
- [https://gitlab.gnome.org/GNOME/glib/-/issues/3872](https://gitlab.gnome.org/GNOME/glib/-/issues/3872)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Related threats

- [GNOME GLib denial of service in GDBus authentication](https://junglewise.ai/threats/cve-2026-15588-gnome-glib-denial-of-service-in-gdbus-authentication)
- [GNOME GLib out-of-bounds read in D-Bus introspection XML parsing](https://junglewise.ai/threats/cve-2026-58016-gnome-glib-out-of-bounds-read-in-d-bus-introspection-xml-parsing)
- [GLib path traversal in GDBus DBUS_COOKIE_SHA1 authentication](https://junglewise.ai/threats/cve-2026-58015-glib-path-traversal-in-gdbus-dbus-cookie-sha1-authentication)
- [GNOME GLib off-by-one error in g_key_file_get_locale_string_list](https://junglewise.ai/threats/cve-2026-58014-gnome-glib-off-by-one-error-in-g-key-file-get-locale-string-list)
- [GNOME GLib buffer over-read in g_io_channel_read_line_backend](https://junglewise.ai/threats/cve-2026-58013-gnome-glib-buffer-over-read-in-g-io-channel-read-line-backend)