Advisory severityHigh7.3Vendor: MediumRed Hat Linux

High [CVE-2026-58014] off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

This high-severity Red Hat Linux advisory covers CVE-2026-58014 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-58014 Source published Jun 30, 2026Source updated Apr 7, 2026

VulniPulse record published Aug 3, 2026

CVE-2026-58014

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value.

This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Any applications loading or parsing untrusted key files, typically.desktop or.ini files, are vulnerable to this issue.

Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Weakness: CWE-193.

Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 22 more.

Affected products named by the advisory: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; and 18 more.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Fixed versions

glib2-0:2.80.4-12.el10_2.21
glib2-0:2.80.4-4.el10_0.17
glib2-0:2.56.1-13.el7_9.1
mingw-glib2-0:2.70.1-9.el8_10
glib2-0:2.56.4-177.el8_10
glib2-0:2.56.4-10.el8_4.7
glib2-0:2.56.4-158.el8_6.7
glib2-0:2.56.4-165.el8_8.2
glib2-0:2.68.4-19.el9_8.9
glib2-0:2.68.4-7.el9_2.7
glib2-0:2.68.4-14.el9_4.8
glib2-0:2.68.4-16.el9_6.7
rhcos-412.86.202609171314-0
rhcos-417.94.202609191027-0
rhcos-4.22.9.8.202609081748-0
cert-manager/cert-manager-operator-rhel9:1788348522
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1788348571
cert-manager/jetstack-cert-manager-rhel9:1788348571
cert-manager/cert-manager-istio-csr-rhel9:1788348594
cert-manager/jetstack-cert-manager-rhel9:1790223279
cert-manager/cert-manager-istio-csr-rhel9:1790223719
cert-manager/cert-manager-operator-rhel9:1790272426
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1790589998
cert-manager/jetstack-cert-manager-rhel9:1790589912
cert-manager/cert-manager-istio-csr-rhel9:1790589914
cert-manager/cert-manager-operator-rhel9:1790589855
cert-manager/cert-manager-trust-manager-rhel9:1790598593
rhaiis/model-opt-cuda-rhel9:1790621714
rhaiis/vllm-cuda-rhel9:1790621718
rhaiis/vllm-rocm-rhel9:1790621713
discovery/discovery-server-rhel9:1788205779
discovery/discovery-ui-rhel9:1788206196
rhai/base-image-rocm-rhel9:1790276886
rhai/base-image-tpu-rhel9:1790276884
rhai/base-image-cpu-rhel9:1790277045
rhai/base-image-spyre-rhel9:1790276889
rhai/base-image-cuda-rhel9:1790276974
rhai/base-image-tpu-rhel9:1790703497
rhai/base-image-rocm-rhel9:1790703506
rhai/base-image-cpu-rhel9:1790703590
RHSA-2026:57015
RHSA-2026:65767
RHSA-2026:65773
RHSA-2026:49512
RHSA-2026:61766
RHSA-2026:65762
RHSA-2026:65769
RHSA-2026:65771
RHSA-2026:55440
RHSA-2026:65768

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Red Hat Security Data APIofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://access.redhat.com/hydra/rest/securitydata/cve.json; this link opens the Red Hat Linux advisory index instead of the raw feed document.
Red Hat Linux
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Red Hat Linux
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-58014NVD CVE.org MITRE

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.