On 21 September 2026 Ubuntu published USN-8794-1, a notice for glib2.0 covering nine CVEs. GLib sits under GTK, GNOME, many CLI tools and a lot of server software that uses GIO or D-Bus, so the package is present on most Linux developer machines and many base images.
Seven of the nine upstream records were published on 30 June 2026. The Ubuntu fix is what turns them into something you can install.
What's affected
Fixed glib2.0 versions in the notice:
| Ubuntu release | Fixed version |
|---|---|
| 26.04 LTS | 2.88.0-1ubuntu0.1 |
| 24.04 LTS | 2.80.0-6ubuntu3.9 |
| 22.04 LTS | 2.72.4-0ubuntu2.10 |
| 20.04, 18.04, 16.04, 14.04 (Ubuntu Pro ESM) | esm builds listed in the notice |
The nine CVEs, from Ubuntu's text and the upstream records:
- CVE-2026-15588: GDBus authentication did not limit the length of data lines read from a client. An unauthenticated client can exhaust resources and cause denial of service.
- CVE-2026-58015: The client side of the
DBUS_COOKIE_SHA1mechanism does not validate thecookie_contextsent by the server. A malicious D-Bus server can use path traversal to make the client read an arbitrary file and leak content by checking guesses against a hash. Upstream rates it CVSS 3.1 with high attack complexity. - CVE-2026-58016: Malformed introspection XML with a nested
nodeelement causes an integer overflow and out-of-bounds read ing_dbus_node_info_new_for_xml(). Denial of service. - CVE-2026-16118: Heap buffer overflow in the xdgmime code when it parses an attacker-controlled MIME magic file on little-endian systems.
- CVE-2026-58010, 58011, 58012, 58013, 58014: Small out-of-bounds reads or writes of 1 to 7 bytes in
GVariant,GDateTime,g_regex_replacewithG_REGEX_RAW,GIOChannelwith a custom line terminator, andGKeyFilewith an empty value. Impacts are minor information disclosure or a crash when a read crosses a page boundary.
How to check if you're exposed
dpkg-query -W libglib2.0-0t64 libglib2.0-0 2>/dev/null
apt list --upgradable 2>/dev/null | grep -i glib
On 22.04 the package is libglib2.0-0, on 24.04 and later libglib2.0-0t64. For containers, run the same dpkg-query through docker run --entrypoint.
Then decide whether you are in the server-facing group. Services that run their own D-Bus or GDBus server (CVE-2026-15588), and tools that connect to untrusted D-Bus peers (CVE-2026-58015), carry the real risk. Most other programs only need the routine update.
What to do now
- Run
sudo apt update && sudo apt upgradeon developer workstations and CI runners, then log out or reboot so desktop sessions load the new library. - Rebuild images that install
libglib2.0-0or a package that depends on it. - List processes still using the old library after the update with
sudo needrestart -bif you have it installed. - If you ship software that bundles GLib in a snap, flatpak or static build, check that vendor's own release notes. The Ubuntu fix does not reach those copies.
Quick check
Which bug involves a malicious D-Bus server reading files on the client?
CVE-2026-58015. The client side of DBUS_COOKIE_SHA1 does not validate the cookie_context value, which allows path traversal.
Does patching the host fix a container that bundles GLib?
No. The image has its own copy, so rebuild it from an updated base.
