Executive brief
GLib is a core utility library used by many Linux-based applications and services to handle data and communication. A vulnerability in how it processes D-Bus messages allows a malicious service to send specially crafted data that crashes any application attempting to interact with it. This can lead to a widespread denial of service, affecting system stability and the availability of various software components.
Technical details
A state confusion vulnerability exists in g_dbus_node_info_new_for_xml() within gio/gdbusintrospection.c. The root cause is a failure in parser_start_element() to properly validate the nesting of <node> elements; specifically, it fails to reject <node> elements nested inside <method>, <signal>, <property>, or <arg> elements. When a nested <interface> tag within such a node is closed, it triggers parse_data_steal_methods(), which resets the shared data->methods array to an empty state. Subsequent attempts by the outer element's closing tag to access the array result in an unsigned integer underflow (0 - 1), leading to a massive out-of-bounds heap read and a segmentation fault. This is reachable via the gdbus command-line tool or any application introspecting a malicious remote D-Bus service.
Affected products
- GNOME GLib All versions prior to June 2026 patch; tested on commit 44bce2fd7
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-02-01: disclosed: Reported via YesWeHack to GNOME
- 2026-06-30: advisory: CVE-2026-58016 published by NVD/Red Hat