CVE-2026-58014: GNOME GLib off-by-one error in g_key_file_get_locale_string_list

CVE-2026-58014 · Severity: high · CVSS 7.3 · Published 2026-06-30

A security flaw was found in GLib, a core library used by many Linux applications to handle configuration files and basic system tasks. An attacker could provide a specially crafted configuration file (such as a .desktop file) containing an empty value that causes the application to crash or potentially leak small amounts of memory. This could lead to a denial of service for affected applications or system components that process untrusted configuration data.

Technologies: Gnome Glib. Vendors: Gnome.

Quick answers

Is CVE-2026-58014 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58014 being exploited in the wild.
How severe is CVE-2026-58014?
High severity, with a CVSS score of 7.3, published 30 June 2026.
Which products and versions are affected?
Gnome Glib 2.6 and later.
Is there a fix for CVE-2026-58014?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58014 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58014?
Check whether you run Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An off-by-one error exists in the `g_key_file_get_locale_string_list()` function within `glib/gkeyfile.c`. When the function processes a key with an empty string value, `strlen(value)` returns 0. The code subsequently attempts to access `value[len - 1]`, which results in an unsigned integer wrap-around to `SIZE_MAX`. This causes a 1-byte heap buffer under-read (and potentially an under-write if the read byte matches the list separator) before the start of the allocated memory. The vulnerability is reachable if an application uses GLib to parse untrusted `.desktop` or configuration files. Impact includes process crashes (DoS) particularly when memory sanitizers or guard pages are active, and potential 1-byte information disclosure of adjacent heap data.

Affected products

  • GNOME GLib 2.6 and later
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 6

Timeline

  • 2026-01-30: disclosed: Reported via YesWeHack
  • 2026-06-24: other: Reported to Red Hat Bugzilla
  • 2026-06-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.