Gnome
Gnome Glib: vulnerabilities and CVEs
Gnome Glib has 42 published vulnerabilities, 15 of them in the last 12 months. 5 are rated critical and 0 are listed by CISA as actively exploited.
CVEs42
Last 12 months15
Critical5
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15588 | Medium (5.3) | 0.48% | — | Jul 20, 2026 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a… |
| CVE-2026-58016 | Critical (9.1) | 0.99% | — | Jun 30, 2026 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element… |
| CVE-2026-58015 | High (7.5) | 0.91% | — | Jun 30, 2026 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can… |
| CVE-2026-58014 | High (8.6) | 0.72% | — | Jun 30, 2026 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access… |
| CVE-2026-58013 | High (8.2) | 0.85% | — | Jun 30, 2026 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the… |
| CVE-2026-58012 | High (8.2) | 0.85% | — | Jun 30, 2026 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes… |
| CVE-2026-58011 | High (7.5) | 0.82% | — | Jun 30, 2026 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function… |
| CVE-2026-58010 | High (8.2) | 0.85% | — | Jun 30, 2026 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=,… |
| CVE-2026-1489 | Medium (5.4) | 0.37% | — | Jan 27, 2026 | A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker… |
| CVE-2026-1485 | Low (2.8) | 0.16% | — | Jan 27, 2026 | A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large… |
| CVE-2026-1484 | Medium (4.2) | 0.35% | — | Jan 27, 2026 | A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause… |
| CVE-2026-0988 | Low (3.7) | 0.44% | — | Jan 21, 2026 | A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are… |
| CVE-2025-14512 | Medium (6.5) | 0.58% | — | Dec 11, 2025 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious… |
| CVE-2025-14087 | Critical (9.8) | 0.83% | — | Dec 10, 2025 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when… |
| CVE-2025-13601 | High (7.7) | 0.32% | — | Nov 26, 2025 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable… |
| CVE-2025-7039 | Low (3.7) | 0.40% | — | Sep 3, 2025 | A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content… |
| CVE-2025-4056 | High (7.5) | 0.45% | — | Jul 28, 2025 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines. |
| CVE-2025-7345 | High (7.5) | 1.2% | — | Jul 8, 2025 | A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer… |
| CVE-2025-6052 | High (7.5) | 0.52% | — | Jun 13, 2025 | A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the… |
| CVE-2025-4373 | Medium (4.8) | 0.61% | — | May 6, 2025 | A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a… |
| CVE-2025-3360 | Low (3.7) | 0.47% | — | Apr 7, 2025 | A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function. |
| CVE-2024-52533 | Critical (9.8) | 1.3% | — | Nov 11, 2024 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character. |
| CVE-2024-34397 | Medium (5.2) | 0.76% | — | May 7, 2024 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other… |
| CVE-2023-32665 | Medium (5.5) | 0.39% | — | Sep 14, 2023 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service. |
| CVE-2023-32643 | High (7.8) | 0.36% | — | Sep 14, 2023 | A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib… |
| CVE-2023-32636 | High (7.5) | 0.78% | — | Sep 14, 2023 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very… |
| CVE-2023-32611 | Medium (5.5) | 0.38% | — | Sep 14, 2023 | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service. |
| CVE-2023-29499 | High (7.5) | 0.77% | — | Sep 14, 2023 | A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. |
| CVE-2021-3800 | Medium (5.5) | 0.56% | — | Aug 23, 2022 | A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition. |
| CVE-2021-28153 | Medium (5.3) | 2.6% | — | Mar 11, 2021 | An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the… |