Executive brief
A security flaw was found in GLib, a core library used by many Linux applications to handle configuration files and basic system tasks. An attacker could provide a specially crafted configuration file (such as a .desktop file) containing an empty value that causes the application to crash or potentially leak small amounts of memory. This could lead to a denial of service for affected applications or system components that process untrusted configuration data.
Technical details
An off-by-one error exists in the `g_key_file_get_locale_string_list()` function within `glib/gkeyfile.c`. When the function processes a key with an empty string value, `strlen(value)` returns 0. The code subsequently attempts to access `value[len - 1]`, which results in an unsigned integer wrap-around to `SIZE_MAX`. This causes a 1-byte heap buffer under-read (and potentially an under-write if the read byte matches the list separator) before the start of the allocated memory. The vulnerability is reachable if an application uses GLib to parse untrusted `.desktop` or configuration files. Impact includes process crashes (DoS) particularly when memory sanitizers or guard pages are active, and potential 1-byte information disclosure of adjacent heap data.
Affected products
- GNOME GLib 2.6 and later
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 6
Timeline
- 2026-01-30: disclosed: Reported via YesWeHack
- 2026-06-24: other: Reported to Red Hat Bugzilla
- 2026-06-30: advisory: NVD publication date