--- id: CVE-2026-58013 title: A flaw was found in GLib summary: >- A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L' cwe: - CWE-126 vendor: gnome product: glib affected: - glib < 2.88.1 - enterprise_linux = 6.0 - enterprise_linux = 7.0 - enterprise_linux = 8.0 - enterprise_linux = 9.0 - enterprise_linux = 10.0 patched: - glib 2.88.1 published: '2026-06-30' updated: '2026-09-10' sourceUpdated: '2026-09-10T18:18:03.590' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58013' references: - url: 'https://access.redhat.com/errata/RHSA-2026:49512' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:55440' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:57015' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:58981' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61766' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61783' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:63135' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:63138' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:63140' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65762' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65763' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65767' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65768' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65769' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65770' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65771' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65773' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:66018' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-58013' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492248' label: secalert@redhat.com - url: 'https://gitlab.gnome.org/GNOME/glib/-/issues/3925' label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58013.json - url: 'https://www.cve.org/CVERecord?id=CVE-2026-58013' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58013' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-06-30T14:17:50.722495Z' epss: 0.00501 epssPercentile: 0.41929 ingestedAt: '2026-08-03T06:23:46.385Z' --- ## Overview A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. ## Affected - `glib < 2.88.1` - `enterprise_linux = 6.0` - `enterprise_linux = 7.0` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `enterprise_linux = 10.0` ## Remediation Upgrade past the affected range: - `glib 2.88.1` ## Vendor advisories - **RHSA-2026:57015** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57015) - **RHSA-2026:55440** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55440) - **RHSA-2026:61766** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61766) - **RHSA-2026:49512** · Red Hat · fixed in: Red Hat Enterprise Linux CRB (v. 8) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49512) - **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783) - **RHSA-2026:58981** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:58981) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58013.json) - **RHSA-2026:65762** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65762) - **RHSA-2026:63140** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63140) - **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135) - **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138) - **RHSA-2026:65773** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65773) - **RHSA-2026:65767** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65767) - **RHSA-2026:65768** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65768) - **RHSA-2026:65770** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65770) - **RHSA-2026:65763** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65763) - **RHSA-2026:65769** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65769) - **RHSA-2026:65771** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65771)