CVE-2026-58011: Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the gdatetimegetymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the gdatetimeaddfull function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Other sources
A global-buffer-overflow (out-of-bounds read) exists in GLib's gdatetimegetymd() function, triggered when operating on an invalid GDateTime object produced by gdatetimeaddfull(). The gdatetimeaddfull() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., gdatetimegetmonth(), gdatetimegetyear()) is subsequently called, the internal gdatetimegetymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.
— Red Hat
Glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd via invalid gdatetime
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.78.6-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58011?
The severity of CVE-2026-58011 is high, rated at 7.5.
How do I fix CVE-2026-58011?
To fix CVE-2026-58011, update to the latest version of GLib that addresses this vulnerability.
What causes CVE-2026-58011?
CVE-2026-58011 is caused by an out-of-bounds read in the g_date_time_get_ymd function due to an invalid GDateTime object.
What are the potential impacts of CVE-2026-58011?
The potential impacts of CVE-2026-58011 include corrupted date output and possible logic errors in applications using affected GLib versions.
Which software is affected by CVE-2026-58011?
CVE-2026-58011 affects Red Hat Enterprise Linux and Gnome GLib.