Executive brief
A vulnerability was found in GLib, a core utility library used by many Linux applications and desktop environments. The flaw occurs when an application performs date calculations that result in an invalid date (such as a year before 0001), which can cause the program to crash or produce incorrect data. This could lead to a denial of service for affected software, such as calendar applications or date pickers, when processing user-supplied input.
Technical details
An out-of-bounds (OOB) read exists in GLib's g_date_time_get_ymd() function within glib/gdatetime.c. The root cause is that g_date_time_add_full() fails to validate if a resulting date falls within the supported range (years 1–9999), allowing the creation of a GDateTime object with a negative or zero 'days' field. When subsequent getter functions like g_date_time_get_month() are called, the internal routine computes a negative array index, resulting in a 2-byte OOB read from the global 'days_in_year' array. This can be triggered by any application using g_date_time_add_full() with user-influenced offsets. The vulnerability has existed since GLib 2.26.
Affected products
- GNOME GLib Since 2.26
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-01-30: disclosed: Reported via YesWeHack
- 2026-06-24: other: Reported to Red Hat Bugzilla
- 2026-06-30: advisory: CVE published and NVD entry created