CyberSecBulletin
CVE-2026-58016NVD status: Modified

GLib: Integer Underflow (Wrap or Wraparound)

Published Updated By the CyberSecBulletin desk

CVE-2026-58016 is a critical-severity integer underflow (wrap or wraparound) vulnerability in GLib from GNOME, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 2.89.0 as the first without the flaw, so updating GLib to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.56% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update GLib to 2.89.0 or a later version.
  2. Update Cert-manager Operator to 1.18.2 or a later version.
  3. Update Openshift Ai to 3.0.3 or 3.2.3 or 3.4.3, whichever matches your release line, or a later version.
  4. Read the advisory on access.redhat.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
GNOMEGLibbefore 2.89.02.89.0
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 10.0 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update ServiceNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.6 Extended Update SupportNot specified in the recordNot stated
Red HatCert Manager support for Red Hat OpenShift release 1.17Not specified in the recordNot stated
Red HatCert Manager support for Red Hat OpenShift release 1.18Not specified in the recordNot stated
Red HatCert Manager support for Red Hat OpenShift release 1.20Not specified in the recordNot stated
Red HatRed Hat Discovery 2Not specified in the recordNot stated
Red HatRed Hat Insights proxy 1.5Not specified in the recordNot stated
Red HatRed Hat OpenShift AI 3.0Not specified in the recordNot stated
Red HatRed Hat OpenShift AI 3.2Not specified in the recordNot stated
Red HatRed Hat OpenShift AI 3.4Not specified in the recordNot stated
Red HatRed Hat Update Infrastructure 5Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 6Not specified in the recordNot stated

Version data comes from the organisation that assigned the CVE; 15 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA (redhat.com)
CVSS 3.19.1CriticalNVD

Official description

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

More Integer Underflow (Wrap or Wraparound) vulnerabilities (CWE-191)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Technical write-ups (may include proof of concept)

Other vulnerabilities in GLib

All GLib vulnerabilities

Recent Integer Underflow (Wrap or Wraparound) vulnerabilities

Spotted an error? Tell us.