Quick answers
- Is CVE-2026-58013 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58013 being exploited in the wild.
- How severe is CVE-2026-58013?
- Medium severity, with a CVSS score of 6.5, published 30 June 2026.
- Which products and versions are affected?
- Gnome Glib All versions supporting g_io_channel_set_line_term with multi-byte terminators.
- Is there a fix for CVE-2026-58013?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-58013 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-58013?
- Check whether you run Gnome Glib, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-buffer-overflow READ vulnerability exists in g_io_channel_read_line_backend() within giochannel.c. The issue is triggered when a custom line terminator with a length greater than one is set via g_io_channel_set_line_term(). The loop condition (nextchar < lastchar) only ensures one byte is available, but the subsequent memcmp call attempts to read line_term_len bytes. If the remaining buffer is smaller than the terminator length, memcmp reads past the GString buffer. This can result in a crash (DoS) if the read crosses a page boundary or a 7-byte information disclosure of adjacent heap memory. A fix involves adding a remaining-bytes check before the memcmp call.
Affected products
- GNOME GLib2 All versions supporting g_io_channel_set_line_term with multi-byte terminators
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-01-30: disclosed: Reported via YesWeHack
- 2026-06-30: advisory: NVD and Red Hat published advisory