Executive brief
GLib is a core utility library used by many Linux applications and desktop environments to handle basic data structures and input/output operations. A flaw in how the library reads lines of text allows an attacker to potentially crash an application or view small amounts of sensitive memory. This occurs when an application is configured to look for specific, multi-character markers to end a line, which could lead to service instability or minor data leaks.
Technical details
A heap-buffer-overflow READ vulnerability exists in g_io_channel_read_line_backend() within giochannel.c. The issue is triggered when a custom line terminator with a length greater than one is set via g_io_channel_set_line_term(). The loop condition (nextchar < lastchar) only ensures one byte is available, but the subsequent memcmp call attempts to read line_term_len bytes. If the remaining buffer is smaller than the terminator length, memcmp reads past the GString buffer. This can result in a crash (DoS) if the read crosses a page boundary or a 7-byte information disclosure of adjacent heap memory. A fix involves adding a remaining-bytes check before the memcmp call.
Affected products
- GNOME GLib2 All versions supporting g_io_channel_set_line_term with multi-byte terminators
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-01-30: disclosed: Reported via YesWeHack
- 2026-06-30: advisory: NVD and Red Hat published advisory