CVE-2026-58014: gnome glib Off-by-one Error
Vulnerability summary
CVE-2026-58014 is a high (CVSS 8.6) Off-by-one Error vulnerability in gnome glib. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 21 · Related 9Timeline
- 30-06-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
+0.07 pp
From 0.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- glib2.0All versions (No fix recorded) | < 2.84.4-3~deb13u4 | < 2.88.1-2
Gnome1 product
- glib< 2.88.1
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0 | 10.0
Ubuntu1 product
- glib2.0< 2.40.2-0ubuntu1.1+esm8 | < 2.48.2-0ubuntu4.8+esm6 | < 2.56.4-0ubuntu0.18.04.9+esm6 | < 2.64.6-1~ubuntu20.04.9+esm2 | < 2.72.4-0ubuntu2.10 | < 2.80.0-6ubuntu3.9 | All versions (No fix recorded) | < 2.88.0-1ubuntu0.1
4 vendors · 4 products
