CVE-2026-58016 is a high severity flaw (CVSS 7.5) in GNOME GLib. Malformed D-Bus introspection XML with a nested node element can cause an unsigned integer overflow and an out-of-bounds read, resulting in denial of service. Apply the GLib update from your distribution; Red Hat lists several errata.
What's affected
- GNOME GLib, in the function g_dbus_node_info_new_for_xml() in gio/gdbusintrospection.c.
- Red Hat Enterprise Linux ships affected GLib builds, per the record.
- Fixed upstream version: not stated in the record. Red Hat errata RHSA-2026:42063, 42089, 42090, 44481, 46836 and 49512 cover specific releases.
How to check if you're exposed
On RPM based systems run rpm -q glib2. On Debian and Ubuntu run dpkg -l libglib2.0-0. Then compare to the fixed package in your distribution advisory. For Red Hat, find the RHSA that matches your minor release.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Find your distribution advisory for this CVE.
- Update the GLib package and restart services that use it, or reboot.
- Rebuild container images that bundle an older GLib.
- Rescan images and hosts to confirm the fix landed.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
GLib is a base library, so one flaw in it reaches many programs. The record describes a state confusion in the XML parser: a node element nested inside method, signal, property or arg elements leads to an unsigned integer overflow (CWE-191 (Integer Underflow)) and then an out-of-bounds read (CWE-125 (Out-of-bounds Read)).
The result in the record is denial of service. The CISA KEV flag is false.
On a typical server GLib is pulled in by many packages, so updating the library package usually fixes every program that uses the shared copy. Statically linked programs and container images that carry their own copy are the exception, and those need a rebuild. Systemd services and desktop components that talk over D-Bus should be restarted so they load the new library.
Try it yourself
Base libraries like GLib hide inside container images. This demo shows how an image scan finds them.
Click through it at your own pace, or open it full screen.
Quick check
Is code execution possible?
The record describes denial of service only.
Sources
Last reviewed: 19 October 2026.
