CVE-2026-58010

Summary

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

Affected Software

VendorProductVersion RangeStatus
GNOMEGLib0 < 2.86.5affected
GNOMEGLib0 < 2.88.1affected
Red HatRed Hat Enterprise Linux 100:2.80.4-12.el10_2.21 < *unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:2.80.4-4.el10_0.17 < *unaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:2.56.1-13.el7_9.1 < *unaffected
Red HatRed Hat Enterprise Linux 80:2.70.1-9.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 80:2.56.4-177.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:2.56.4-10.el8_4.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:2.56.4-10.el8_4.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:2.56.4-158.el8_6.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:2.56.4-158.el8_6.7 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:2.56.4-165.el8_8.2 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:2.56.4-165.el8_8.2 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.68.4-19.el9_8.9 < *unaffected
Red HatRed Hat Enterprise Linux 90:2.68.4-19.el9_8.9 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:2.68.4-7.el9_2.7 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:2.68.4-14.el9_4.8 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:2.68.4-16.el9_6.7 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.191788348522 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.191788348571 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.191788348571 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.191788348594 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790223279 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790223719 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790272426 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790589998 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790589912 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790589914 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790589855 < *unaffected
Red HatCert Manager support for Red Hat OpenShift release 1.201790598593 < *unaffected
Red HatRed Hat AI Inference Server 3.21790621714 < *unaffected
Red HatRed Hat AI Inference Server 3.21790621718 < *unaffected
Red HatRed Hat AI Inference Server 3.21790621713 < *unaffected
Red HatRed Hat Discovery 21788205779 < *unaffected
Red HatRed Hat Discovery 21788206196 < *unaffected
Red HatRed Hat OpenShift AI 3.01790276886 < *unaffected
Red HatRed Hat OpenShift AI 3.01790276884 < *unaffected
Red HatRed Hat OpenShift AI 3.01790277045 < *unaffected
Red HatRed Hat OpenShift AI 3.01790276889 < *unaffected
Red HatRed Hat OpenShift AI 3.01790276974 < *unaffected
Red HatRed Hat OpenShift AI 3.21790703497 < *unaffected
Red HatRed Hat OpenShift AI 3.21790703506 < *unaffected
Red HatRed Hat OpenShift AI 3.21790703590 < *unaffected
Red HatRed Hat OpenShift AI 3.21790703568 < *unaffected
Red HatRed Hat OpenShift AI 3.21790703586 < *unaffected
Red HatRed Hat OpenShift AI 3.21790703494 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703542 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703539 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703553 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703631 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703597 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703641 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703630 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703541 < *unaffected
Red HatRed Hat OpenShift AI 3.41790703545 < *unaffected
Red HatRed Hat OpenShift AI 3.51790703552 < *unaffected
Red HatRed Hat Update Infrastructure 51787241211 < *unaffected
Red HatRed Hat Update Infrastructure 51787135742 < *unaffected
Red HatRed Hat Update Infrastructure 51787241260 < *unaffected
Red HatRed Hat Update Infrastructure 51788880445 < *unaffected
Red HatRed Hat Update Infrastructure 51788880464 < *unaffected
Red HatRed Hat Update Infrastructure 51788880456 < *unaffected
Red HatRed Hat Update Infrastructure 51788765051 < *unaffected
Red HatRed Hat Update Infrastructure 51788880581 < *unaffected

Weaknesses

  • CWE-126: Buffer Over-read

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References