CVE-2026-58016: Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-30 · updated 2026-10-29
Weakness: CWE-191

Description

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

Affected products

GNOME GLib: before 2.89.0 — fixed in 2.89.0
Redhat Cert-Manager Operator: from 1.18.0 before 1.18.2; 1.17.0, 1.20.0 (and their updates) — fixed in 1.18.2
RedHat Codeready Linux Builder: 8.0, 9.0, 10.0 (and their updates)
RedHat Codeready Linux Builder Eus: 9.6, 10.0 (and their updates)
RedHat Discovery: 2.0 (and their updates)
Red Hat Enterprise Linux: 6.0, 8.0, 9.0, 10.0 (and their updates)
RedHat Enterprise Linux Aus: 8.4, 8.6 (and their updates)
RedHat Enterprise Linux Els: 7.0 (and their updates)
RedHat Enterprise Linux Eus: 8.4, 8.6, 9.6, 10.0 (and their updates)
RedHat Enterprise Linux Server Tus: 8.8 (and their updates)
RedHat Enterprise Linux Update Services For Sap Solutions: 8.8, 9.2, 9.4 (and their updates)
Redhat Insights-Proxy: 1.5.0 (and their updates)
Red Hat OpenShift AI 2.25: from 3.0 before 3.0.3; from 3.2 before 3.2.3; from 3.4 before 3.4.3 — fixed in 3.0.3, 3.2.3, 3.4.3
RedHat Update Infrastructure: from 5.0 before 5.2 — fixed in 5.2

How to fix

Upgrade to a fixed version: GNOME GLib 2.89.0; Redhat Cert-Manager Operator 1.18.2; Red Hat OpenShift AI 2.25 3.0.3, 3.2.3, 3.4.3; RedHat Update Infrastructure 5.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-58016 or the next vulnerability affects your stack