CVE-2024-34397

GLib vulnerability CVE-2024-34397: a GDBus signal-subscription spoofing flaw allows non-trusted local users on shared systems to inject spoofed D-Bus signals, potentially making a GDBus client misbehave (application-dependent impact). Affected: GLib’s GDBus-based clients; vulnerable in GLib up to...

CVE-2021-27219

GLib’s g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64-bit to 32-bit, affecting GNOME GLib up to 2.66.6 and 2.67.x up to 2.67.3. This can lead to memory corruption. Concrete impact is described across multiple advisories (glib2.0) and vendor bulletins; miti...

CVE-2025-14087

CVE-2025-14087 describes a buffer-underflow in GLib’s GVariant parser that can cause heap corruption, potentially leading to denial of service or remote code execution when processing crafted input strings. The connected advisories pin the vulnerability to GLib (glib2) across multiple packages an...

CVE-2021-27218

CVE-2021-27218 concerns GNOME GLib. On 64-bit platforms, if g_byte_array_new_take() is called with a buffer of 4GB or more, the length is truncated modulo 2**32, causing unintended length truncation. Affected: GLib before 2.66.7 and 2.67.x before 2.67.4. Impact is described as length miscalculati...

CVE-2021-28153

GLib/GNOME GLib before 2.66.8 is affected by CVE-2021-28153: when g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it may create the target as an empty file. This behavior could be security-relevant if the symlink is attacker-controlled...

CVE-2021-3800

CVE-2021-3800 (glib2.0) is a flaw in GLib before version 2.63.6 where a random charset alias can cause pkexec to leak content from files owned by privileged users to unprivileged ones under certain conditions. Public references in the connected docs confirm this impact as information disclosure v...

CVE-2023-29499

CVE-2023-29499 affects GLib’s GVariant deserialization. The root cause is that input is not validated to the expected format, allowing a crafted payload to trigger a denial of service. Public documents describe the issue as a vulnerability in GLib’s GVariant handling and note that fixes update GL...

CVE-2023-32643

CVE-2023-32643 affects GLib’s GVariant deserialization and is described in connected advisories as a heap buffer overflow introduced by backporting the fix for CVE-2023-32665. The vulnerability path involves the GVariant deserialization code and is tied to backported changes rather than an announ...

CVE-2024-52533

GLib (GNOME GLib) is affected by CVE-2024-52533 due to an off-by-one error in gio/gsocks4aproxy.c, where SOCKS4_CONN_MSG_LEN does not account for a trailing NUL, causing a buffer overflow in versions before 2.82.1. The issue stems from an insufficient buffer size in SOCKS4_CONN_MSG_LEN. A fix has...

CVE-2023-32665

GLib's GVariant deserialization vulnerability (CVE-2023-32665) enables denial of service via an exponential blowup with crafted GVariant inputs. The issue is tied to GLib's GVariant handling and is discussed across multiple advisories (CVE-2023-29499, CVE-2023-32611, CVE-2023-32665). Public resol...

CVE-2023-32611

CVE-2023-32611 is a GLib (glib2) vulnerability where GVariant deserialization can cause excessive processing, leading to denial of service. Connected advisories report affected packages as glib2 across multiple distributions (e.g., Debian, AlmaLinux, CBL-Mariner, Astra Linux, Alpine Linux) with o...

CVE-2023-32636

GLib: CVE-2023-32636 describes a DoS in GVariant deserialization caused by slow offset table validation; the description notes that no released GLib version is affected, but distributors who backported the CVE-29499 fix may be impacted. Connected advisories (including Broadcom/ALAS and AlmaLinux)...

CVE-2020-35457

CVE-2020-35457 affects GNOME GLib (glib2) before 2.65.3, with an integer overflow in g_option_group_add_entries that could lead to an out-of-bounds write. Connected advisories confirm multiple vendors/distros reference a patch in GLib2; updates are available (e.g., GLib2 2.65.3+ or distro-specifi...

CVE-2026-58016

The CVE-2026-58016 entry concerns GLib, specifically a flaw in g_dbus_node_info_new_for_xml() in gio/gdbusintrospection.c. The issue arises when parsing malformed D-Bus introspection XML (notably a element nested inside ///), causing an unsigned integer overflow and an out-of-bounds read, which ...

CVE-2025-4056

CVE-2025-4056 affects GLib. The issue is a denial-of-service on Windows when an application spawns a program with long command lines. Public sources in connected advisories note GLib vulnerability details and remediation: upgrading GLib to a patched release (e.g., GLib 2.84.1+ per EulerOS/Nessus ...

CVE-2025-13601

CVE-2025-13601 affects GLib’s g_escape_uri_string() where an integer overflow in buffer size calculation can cause a heap-based overflow when escaping strings with many invalid characters. Consequences are described as potential write past the end of the allocated buffer, leading to memory corrup...

CVE-2025-14512

CVE-2025-14512 affects GLib2 (glib2) in IBM Netezza Appliance. The IBM security bulletin confirms a vulnerability in GLib’s GIO escape_byte_string() that can cause a heap-based buffer overflow leading to DoS when processing certain file or remote filesystem attribute values. Remediation: upgrade ...

CVE-2026-58015

CVE-2026-58015 affects GLib’s D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL mechanism. The cookie_context parameter received from the server is not validated, allowing a malicious D-Bus server to supply a cookie_context with path traversal sequences. This can enable reading an arb...

CVE-2026-58013

GLib vulnerability CVE-2026-58013: a buffer over-read in g_io_channel_read_line_backend() (giochannel.c) occurs when a custom line terminator length > 1 is set, causing memcmp to read past the GString buffer. This can enable a minor information disclosure of 7 bytes or a denial of service when...

CVE-2026-58011

CVE-2026-58011 (GLib) : A flaw in GLib’s g_date_time_get_ymd (glib/gdatetime.c) allows an out-of-bounds read of 2 bytes when an invalid GDateTime object from g_date_time_add_full is processed. This can corrupt date output and potentially cause logic errors leading to a denial of service. Exploita...

CVE-2026-58012

CVE-2026-58012 affects GLib. A buffer over-read can occur in g_regex_replace when used with the G_REGEX_RAW flag and case-change replacement escapes because string_append processes matched substrings with UTF-8 functions that expect valid UTF-8 input, even when treated as raw bytes. Impact: minor...

CVE-2026-58014

GLib contains an off-by-one flaw in g_key_file_get_locale_string_list (gkeyfile.c) that triggers when loading a key file with an empty value. The issue allows an out-of-bounds access of one byte and can cause denial of service if the access crosses a page boundary. Affected component is GLib’s ke...

CVE-2026-58010

GLib contains a vulnerability CVE-2026-58010: an off-by-one in gvs_tuple_is_normal() within glib/gvariant-serialiser.c triggers an out-of-bounds read of 1 byte during an alignment padding bounds check (uses > instead of >=). This can lead to a minor information disclosure of 1 byte and a de...