CVE-2026-58013 GNOME CVE debrief

Who should care

Defenders managing systems using GLib, especially those with custom line terminator configurations, should assess exposure and prioritize patching. Red Hat Enterprise Linux users should review relevant errata for affected systems.

Why it matters

CVE-2026-58013 is a buffer over-read vulnerability in GLib's g_io_channel_read_line_backend() function. Defenders should care because it can cause denial of service or minor information disclosure, particularly in systems using custom line terminators. Affected systems, primarily those using GLib versions prior to 2.88.1, should be identified and patched. Red Hat Enterprise Linux users should review and apply relevant errata. Evidence from official sources is limited, so verification of affected versions and exposure is necessary.

• Denial of service when buffer over-read crosses a page boundary
• Minor information disclosure of up to 7 bytes

Technical summary

The g_io_channel_read_line_backend() function in GLib's giochannel.c file has a buffer over-read vulnerability. This occurs when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. The vulnerability can lead to minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Affected systems, primarily those using GLib versions prior to 2.88.1, should be identified and patched. Red Hat Enterprise Linux users should review and apply relevant errata.

Defensive priority

Defenders should prioritize verifying and applying patches for GLib, particularly in systems using custom line terminators. Inventory checks for affected versions and monitoring for potential denial-of-service conditions are recommended.

Recommended defensive actions

• Verify and apply GLib patches, especially for custom line terminator usage
• Conduct inventory checks for affected GLib versions
• Monitor systems for potential denial-of-service conditions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. Red Hat errata RHSA-2026:49512, RHSA-2026:55440, RHSA-2026:57015, and others reference this CVE, indicating affected systems and potential fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.