CVE-2026-58014
Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
Using Red Hat Enterprise Linux 10 by Red Hat?
Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 10 - before attackers find them.
Description
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
VTDB RemediationFix available
VTDB RemediationAI-generated · claude-fable-5-1 · published by VulnTracker
Apply the Red Hat glib2 errata for your RHEL release (vendor-stated fixed packages such as glib2-2.68.4-19.el9_8.9 and glib2-2.80.4-12.el10_2.21) and rebuild on upstream GLib 2.88.1, which is our inferred boundary from the affected range.
- 1
Patch RHEL hosts to the vendor-stated glib2 build for their stream
Red Hat states these glib2 package versions are not affected: RHEL 7.9 0:2.56.1-13.el7_9.1; RHEL 8.4 0:2.56.4-10.el8_4.7; RHEL 8.6 0:2.56.4-158.el8_6.7; RHEL 8.8 0:2.56.4-165.el8_8.2; RHEL 8.10 0:2.56.4-177.el8_10 and 0:2.70.1-9.el8_10; RHEL 9.2 0:2.68.4-7.el9_2.7; RHEL 9.4 0:2.68.4-14.el9_4.8; RHEL 9.6 0:2.68.4-16.el9_6.7; RHEL 9.8 0:2.68.4-19.el9_8.9; RHEL 10.0 0:2.80.4-4.el10_0.17; RHEL 10.2 0:2.80.4-12.el10_2.21. Install the matching erratum and restart long-running services that have glib2 loaded. RHEL 6 is listed as affected with no fix row.
https://access.redhat.com/security/cve/CVE-2026-58014 - 2
Update OpenShift Container Platform nodes to the fixed RHCOS builds
Red Hat states these node image builds are not affected: 412.86.202609171314-0, 413.92.202609302032-0, 414.92.202609282130-0, 415.92.202610081130-0, 416.94.202609281908-0, 417.94.202609191027-0 and 4.22.9.8.202609081748-0. Move each cluster to the z-stream release that carries its build, using the RHSA errata listed on the CVE page.
Fix rows for redhat-openshift-container-platform, version_source vendor.statement.
- 3
Update layered Red Hat products through their errata
Red Hat records fixed releases for cert-manager Operator for OpenShift (including the 1.17 and 1.18 support streams), OpenShift AI, AI Inference Server, Discovery, Update Infrastructure and Hardened Images, but the recorded fix identifiers are internal release IDs that cannot be compared with an installed version. For these, apply the RHSA erratum for the product from the CVE page and verify by erratum number rather than by version string.
https://access.redhat.com/errata/RHSA-2026:49512 - 4
Rebuild non-Red Hat deployments on GLib 2.88.1 or later
Upstream GLib below 2.88.1 is recorded as affected; 2.88.1 is inferred from the upper bound of that range and is not a GNOME-stated fixed version in our data. For containers, appliances and self-built software bundling GLib, rebuild against 2.88.1 or take the distribution's patched glib2.
Affected range gnome-glib end_excl 2.88.1; fix row 2.88.1 version_source derived.range.
- 5
Prioritise services that parse untrusted key files
The flaw triggers when g_key_file_get_locale_string_list loads a key file with an empty value, so the exposure is any network-reachable service that parses attacker-supplied .ini/.desktop-style key files through GLib. Patch those first; a public proof of concept is recorded.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (NVD 8.6); SSVC exploitation: poc.
If you cannot apply the fix
None recorded. Reducing the set of services that load untrusted key files limits exposure but is our inference from the description, not a vendor mitigation.
Fix rows are of mixed kinds and are kept apart above: the RHEL glib2 NVRs and OpenShift RHCOS builds are vendor statements; the GLib 2.88.1 version is derived from the range upper bound; and one RHEL 10.2 row carries version_source 'cpe22', which is not one of the three recognised sources, though a duplicate vendor.statement row gives the same NVR. The numeric fix identifiers for cert-manager, OpenShift AI, AI Inference Server, Discovery, Update Infrastructure (many duplicated as matchable true and false) and the value '1' for Hardened Images are not comparable version strings and were treated as unmatchable. RHEL 6.0 is listed as affected with no fix row. More than seventy RHSA errata are referenced without a mapping to products in our data, so the CVE page is cited as the index. The GNOME GitLab issue is tagged Exploit and was not used. Exploitation in the wild is not recorded (EPSS 0.00488, percentile 0.411).
Fixed in
Guidance updated 2026-10-23
References (83)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- HIGH
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.