Is CVE-2026-58016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58016 being exploited in the wild.

How severe is CVE-2026-58016?

High severity, with a CVSS score of 7.5, published 30 June 2026.

Which products and versions are affected?

Gnome Glib All versions prior to June 2026 patch; tested on commit 44bce2fd7.

Is there a fix for CVE-2026-58016?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58016 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58016?

Check whether you run Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58016: GNOME GLib out-of-bounds read in D-Bus introspection XML parsing

CVE-2026-58016 · Severity: high · CVSS 7.5 · Published 2026-06-30

GLib is a core utility library used by many Linux-based applications and services to handle data and communication. A vulnerability in how it processes D-Bus messages allows a malicious service to send specially crafted data that crashes any application attempting to interact with it. This can lead to a widespread denial of service, affecting system stability and the availability of various software components.

Technologies: Gnome Glib. Vendors: Gnome.

Quick answers

Is CVE-2026-58016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58016 being exploited in the wild.
How severe is CVE-2026-58016?: High severity, with a CVSS score of 7.5, published 30 June 2026.
Which products and versions are affected?: Gnome Glib All versions prior to June 2026 patch; tested on commit 44bce2fd7.
Is there a fix for CVE-2026-58016?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58016 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58016?: Check whether you run Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A state confusion vulnerability exists in g_dbus_node_info_new_for_xml() within gio/gdbusintrospection.c. The root cause is a failure in parser_start_element() to properly validate the nesting of <node> elements; specifically, it fails to reject <node> elements nested inside <method>, <signal>, <property>, or <arg> elements. When a nested <interface> tag within such a node is closed, it triggers parse_data_steal_methods(), which resets the shared data->methods array to an empty state. Subsequent attempts by the outer element's closing tag to access the array result in an unsigned integer underflow (0 - 1), leading to a massive out-of-bounds heap read and a segmentation fault. This is reachable via the gdbus command-line tool or any application introspecting a malicious remote D-Bus service.

Affected products

GNOME GLib All versions prior to June 2026 patch; tested on commit 44bce2fd7
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10

Timeline

2026-02-01: disclosed: Reported via YesWeHack to GNOME
2026-06-30: advisory: CVE-2026-58016 published by NVD/Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.