CVE-2026-16118

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A vulnerability was discovered in the GDBusServer component of GNOME GLib, related to improper resource shutdown or release. The product does not release or incorrectly releases a resource before it is made available for re-use, leading to resource leakage. An attacker could potentially exploit this vulnerability by sending a large number of requests to GDBusServer, consuming system resources and causing a denial of service.(CVE-2026-15588)

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.(CVE-2026-16118)

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A vulnerability was discovered in the GDBusServer component of GNOME GLib, related to improper resource shutdown or release. The product does not release or incorrectly releases a resource before it is made available for re-use, leading to resource leakage. An attacker could potentially exploit this vulnerability by sending a large number of requests to GDBusServer, consuming system resources and causing a denial of service.(CVE-2026-15588)

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.(CVE-2026-16118)

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.(CVE-2026-16118)

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.

Security Fix(es):

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.(CVE-2026-16118)

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

• xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-16118: fix a 2-byte out-of-bounds write in the little-endian byte-swap loop of _xdg_mime_magic_parse_magic_line() in the bundled xdgmime

• CVE-2026-16118: parenthesise (ptr + i) before the cast in the little-endian byte-swap loop of _xdg_mime_magic_parse_magic_line(), fixing a 2-byte out-of-bounds write in the bundled xdgmime
• skip the upstream-flaky testfilemonitor test in %check; it aborts intermittently on aarch64 builders and blocks the build

• CVE-2026-16118: fix a 2-byte out-of-bounds write in the little-endian byte-swap of _xdg_mime_magic_parse_magic_line() by parenthesizing (ptr + i) before the cast, so the write side uses byte offsets instead of scaling by the word size

• CVE-2026-16118: fix a heap out-of-bounds write in the little-endian byte-swap of MIME magic values in _xdg_mime_magic_parse_magic_line() (gio/xdgmime/xdgmimemagic.c) by parenthesizing (ptr + i) before the cast so the write side uses byte offsets instead of scaling by the word size

• SECURITY UPDATE: Heap buffer overflow in the little-endian byte-swap of MIME magic values
  • debian/patches/CVE-2026-16118.patch: parenthesize (ptr + i) before the cast so the write side of the byte-swap uses byte offsets instead of scaling by the word size in _xdg_mime_magic_parse_magic_line() in gio/xdgmime/xdgmimemagic.c
  • CVE-2026-16118

• CVE-2026-16118: fix a heap out-of-bounds write in the little-endian byte-swap of MIME magic values in _xdg_mime_magic_parse_magic_line() (gio/xdgmime/xdgmimemagic.c) by parenthesizing (ptr + i) before the cast so the write side uses byte offsets instead of scaling by the word size

• SECURITY UPDATE: heap buffer overflow when byte-swapping MIME magic values on little-endian systems
  • debian/patches/CVE-2026-16118.patch: fix pointer arithmetic on the write side of the byte swap in _xdg_mime_magic_parse_magic_line()
  • CVE-2026-16118

• SECURITY UPDATE: heap buffer overflow when byte-swapping MIME magic values
  • debian/patches/CVE-2026-16118.patch: apply the byte offset before the cast on the write side of the byte swap in _xdg_mime_magic_parse_magic_line() in gio/xdgmime/xdgmimemagic.c
  • CVE-2026-16118

• SECURITY UPDATE: heap buffer overflow when byte-swapping MIME magic values on little-endian systems
  • debian/patches/CVE-2026-16118.patch: fix pointer arithmetic on the write side of the byte swap in _xdg_mime_magic_parse_magic_line()
  • CVE-2026-16118

Root has patched CVE-2026-16118 in the glib2.0 package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-16118 in the glib2.0 package for Root:Debian:12. Multiple fixed versions available.

It was discovered that GLib's GDBus authentication mechanism failed to enforce length limitations on data lines read from a client. An unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion. (CVE-2026-15588)

It was discovered that the xdgmime library in GLib had a heap-based buffer overflow. An attacker-controlled MIME magic file could cause an out-of-bounds write on little-endian systems. (CVE-2026-16118)

It was discovered that GLib had an off-by-one error in the GVariant serialiser. An attacker could use this to cause an out-of-bounds read, leading to information disclosure or a denial of service. (CVE-2026-58010)

It was discovered that GLib had an out-of-bounds read in GDateTime. An attacker could use this to corrupt date output and cause a denial of service. (CVE-2026-58011)

It was discovered that GLib's g_regex_replace() function had a buffer over-read when used with the G_REGEX_RAW flag. An attacker could use this to cause information disclosure or a denial of service. (CVE-2026-58012)

It was discovered that GLib's GIOChannel had a buffer over-read when using a custom line terminator. An attacker could use this to cause information disclosure or a denial of service. (CVE-2026-58013)

It was discovered that GLib's GKeyFile had an off-by-one error when loading a key file with an empty value. An attacker could use this to cause an out-of-bounds access or a denial of service. (CVE-2026-58014)

It was discovered that GLib's DBUS_COOKIE_SHA1 authentication mechanism failed to validate the cookie_context parameter. A malicious D-Bus server could use this to read arbitrary files from the client. (CVE-2026-58015)

It was discovered that GLib's D-Bus introspection XML parser had a state confusion issue. An attacker could use this to cause an out-of-bounds read and denial of service. (CVE-2026-58016)