Skip to content
VulniPulse
Sign in
Advisory severityMedium6.5Red Hat Linux

Medium [CVE-2026-58013] buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

This medium-severity Red Hat Linux advisory covers CVE-2026-58013 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-58013 Source published Source updated

VulniPulse record published

CVE-2026-58013
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer.

This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue.

Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

Weakness: CWE-126.

Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 19 more.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Fixed versions
  • glib2-0:2.80.4-12.el10_2.21
  • glib2-0:2.80.4-4.el10_0.17
  • glib2-0:2.56.1-13.el7_9.1
  • mingw-glib2-0:2.70.1-9.el8_10
  • glib2-0:2.56.4-177.el8_10
  • glib2-0:2.56.4-10.el8_4.7
  • glib2-0:2.56.4-158.el8_6.7
  • glib2-0:2.56.4-165.el8_8.2
  • glib2-0:2.68.4-19.el9_8.9
  • glib2-0:2.68.4-7.el9_2.7
  • glib2-0:2.68.4-14.el9_4.8
  • glib2-0:2.68.4-16.el9_6.7
  • cert-manager/cert-manager-operator-rhel9:1788348522
  • cert-manager/jetstack-cert-manager-acmesolver-rhel9:1788348571
  • cert-manager/jetstack-cert-manager-rhel9:1788348571
  • cert-manager/cert-manager-istio-csr-rhel9:1788348594
  • cert-manager/jetstack-cert-manager-rhel9:1790223279
  • cert-manager/cert-manager-istio-csr-rhel9:1790223719
  • cert-manager/cert-manager-operator-rhel9:1790272426
  • cert-manager/jetstack-cert-manager-acmesolver-rhel9:1790589998
  • cert-manager/jetstack-cert-manager-rhel9:1790589912
  • cert-manager/cert-manager-istio-csr-rhel9:1790589914
  • cert-manager/cert-manager-operator-rhel9:1790589855
  • cert-manager/cert-manager-trust-manager-rhel9:1790598593
  • rhaiis/model-opt-cuda-rhel9:1790621714
  • rhaiis/vllm-cuda-rhel9:1790621718
  • rhaiis/vllm-rocm-rhel9:1790621713
  • discovery/discovery-server-rhel9:1788205779
  • discovery/discovery-ui-rhel9:1788206196
  • rhai/base-image-rocm-rhel9:1790276886
  • rhai/base-image-tpu-rhel9:1790276884
  • rhai/base-image-cpu-rhel9:1790277045
  • rhai/base-image-spyre-rhel9:1790276889
  • rhai/base-image-cuda-rhel9:1790276974
  • rhai/base-image-tpu-rhel9:1790703497
  • rhai/base-image-rocm-rhel9:1790703506
  • rhai/base-image-cpu-rhel9:1790703590
  • rhai/base-image-spyre-rhel9:1790703568
  • rhai/base-image-cuda-rhel9:1790703586
  • rhai/base-image-rocm-rhel9:1790703494
  • RHSA-2026:57015
  • RHSA-2026:65767
  • RHSA-2026:65773
  • RHSA-2026:49512
  • RHSA-2026:61766
  • RHSA-2026:65762
  • RHSA-2026:65769
  • RHSA-2026:65771
  • RHSA-2026:55440
  • RHSA-2026:65768

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue.

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.