CoreCVE
Back

HIGH

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Published Jun 30, 2026

Description

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

Affected products

Remediation

Vendor solution

To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.

Red Hat statement

Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.

Red Hat mitigation

To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.

Weaknesses (1)

CWE-193

References (66)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner redhat
Published Jun 30, 2026
Updated Oct 6, 2026
Reserved Jun 26, 2026
Link CVE-2026-58014

CISA Vulnrichment

Updated Jun 30, 2026

NVD

Status Modified
Modified Oct 6, 2026
Link CVE-2026-58014

Red Hat

Severity Moderate
Public date Apr 7, 2026
Bugzilla 2492255
Link CVE-2026-58014

ENISA EUVD

Assigner redhat
Published Jun 30, 2026
Updated Oct 6, 2026
Link EUVD-2026-40316

GitHub

No data