Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-58016

critical

A flaw was found in GLib.

Vendor / product: Gnome — glib

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-06-30 13:19
Modified: 2026-10-29 14:16
NVD status: Analyzed
Last synced 2 hours ago
Verified against the source API 2026-10-29 14:37 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

gnome / glib <2.89.0
redhat / cert-manager_operator ≥1.18.0 <1.18.2, 1.17.0, 1.20.0
redhat / codeready_linux_builder 8.0, 9.0, 10.0
redhat / codeready_linux_builder_eus 9.6, 10.0
redhat / discovery 2.0
redhat / insights-proxy 1.5.0
redhat / openshift_ai ≥3.0 <3.0.3, ≥3.2 <3.2.3, ≥3.4 <3.4.3
redhat / update_infrastructure ≥5.0 <5.2
redhat / enterprise_linux 6.0, 8.0, 9.0, 10.0
redhat / enterprise_linux_aus 8.4, 8.6
redhat / enterprise_linux_els 7.0
redhat / enterprise_linux_eus 8.4, 8.6, 9.6, 10.0
redhat / enterprise_linux_server_tus 8.8
redhat / enterprise_linux_update_services_for_sap_solutions 8.8, 9.2, 9.4

Weakness classification (CWE)

CWE-191

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://access.redhat.com/errata/RHSA-2026:42063
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:42089
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:42090
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:44481
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:46836
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:49512
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:51175
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:51176
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:51177
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:51181

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-29 14:37 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-5201CVE-2026-58014CVE-2026-102560CVE-2026-102559CVE-2026-102558