CVE-2026-58016

CriticalCVSS 9.1/10Last modified Nov 10, 2026

Description

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-191

Affected software

VendorProductVersions
GNOMEGLib< 2.89.0
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatRed Hat Discovery 2—
Red HatRed Hat Discovery 2—
Red HatRed Hat Insights proxy 1.5—
Red HatRed Hat OpenShift AI 3.0—
Red HatRed Hat OpenShift AI 3.0—
Red HatRed Hat OpenShift AI 3.0—
Red HatRed Hat OpenShift AI 3.0—
Red HatRed Hat OpenShift AI 3.0—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.2—
Red HatRed Hat OpenShift AI 3.2—

References

Timeline

Published
Jun 30, 2026
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-58027.3A vulnerability was identified in idachev mcp-javadc up to 1.2.4. Impacted is an unknown function of the component HTTP Interface. Such maniCVE-2026-580239.1Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended CVE-2026-580245.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associatCVE-2026-580259.8Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files incCVE-2026-580265.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associatCVE-2026-580276.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associCVE-2026-580285.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki,CVE-2026-580296.5Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationDCVE-2026-58036.3A security flaw has been discovered in bigsk1 openai-realtime-ui up to 188ccde27fdf3d8fab8da81f3893468f53b2797c. The affected element is an CVE-2026-580306.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighCVE-2026-580315.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.CVE-2026-580326.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.
CVE-2026-58016: Critical severity, CVSS 9.1 | Vulnix