CVE-2026-58016: GLib D-Bus Introspection Parser Out-of-Bounds Read

CVE-2026-58016 is a CWE-191 (Integer Underflow) flaw in GLib's gio/gdbusintrospection.c that lets malformed D-Bus introspection XML — a <node> element nested inside a <method>, <signal>, <property> or <arg> element — trick the parser into swapping a shared array for an empty one, so that when a getter function later computes an index via an unsigned size-minus-one operation on the now-empty array it wraps around to 0xFFFFFFFF and reads far out of bounds, crashing any process (including the gdbus CLI tool) that parses introspection data from an untrusted or compromised D-Bus service.

CVE-2026-58016 affects GLib, the core low-level utility library underpinning GTK, GNOME, and a large share of the Linux desktop and application stack, specifically its D-Bus introspection XML parser. The GNOME issue tracker describes the vulnerable code precisely: the bug lives in parse_data_get_method() in gio/gdbusintrospection.c, with the same flawed pattern repeated in the sibling getters parse_data_get_signal(), parse_data_get_property(), and parse_data_get_arg() (GNOME GLib issue #3932).

The trigger is a crafted piece of introspection XML containing a <node> element nested inside a <method>, <signal>, <property> or <arg> element — a structure the parser does not reject. When the XML parser reaches the inner element's closing </interface> tag, it "steals" the shared array (of methods, signals, etc.) that the outer element was accumulating and replaces it with a fresh, empty array. When the outer element's own closing tag is later processed, it calls the corresponding getter function, which computes an array index using an unsigned subtraction that assumes at least one element is present; against the now-empty array this becomes 0u - 1, which wraps around to 0xFFFFFFFF on an unsigned 32-bit value. The result, as the issue describes it, is "an out-of-bounds heap read at offset 0xFFFFFFFF × sizeof(gpointer) (~8GB before the buffer)" (GNOME GLib issue #3932).

Any application calling g_dbus_node_info_new_for_xml() on introspection data it does not fully control is exposed; the issue specifically calls out the gdbus command-line tool, which parses introspection XML returned by a remote D-Bus service and is therefore vulnerable to a malicious or compromised peer on the bus. The proposed remediation is twofold: tighten parser_start_element() so a <node> cannot appear nested inside a <method>/<signal>/<property>/<arg> context in the first place, and add explicit empty-array guards to each of the affected getter functions before they compute an index (GNOME GLib issue #3932).

NVD's own analysis rates this CVSS v3.1 Primary 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H — network attack vector, low complexity, no privileges or user interaction, with the confidentiality impact reflecting the out-of-bounds heap read's potential to leak memory contents alongside the availability-impacting crash. Red Hat's own Secondary scoring is notably lower, CVSS v3.1 7.5, reflecting a confidentiality-impact-free (C:N) denial-of-service-only assessment; this page uses NVD's Primary rating as authoritative (NVD). The fix is included in GLib 2.89.0, and Red Hat has shipped dozens of RHSA errata backporting the patch across RHEL, OpenShift and related products, underscoring how widely GLib is embedded (Red Hat CVE page).

As of this review, the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match, and FIRST scores the probability of exploitation at 0.0056 (46.587th percentile) as of 2026-10-30 — a middling figure consistent with a widely-deployed library flaw that requires a peer able to feed it crafted D-Bus introspection XML, not a directly internet-reachable service (FIRST EPSS; CISA KEV catalog). Given how broadly GLib is embedded in Linux userspace, operators should prioritize the distribution security updates (Red Hat's RHSA list above, or the equivalent for other distributions) that backport the GLib 2.89.0 fix rather than attempting to patch GLib standalone.

• The vulnerable code is in parse_data_get_method() in gio/gdbusintrospection.c, with the same flaw pattern in parse_data_get_signal(), parse_data_get_property(), and parse_data_get_arg(). — GNOME GLib issue #3932
• A <node> element nested inside a <method>/<signal>/<property>/<arg> element causes the parser to steal and replace the shared array with an empty one; the outer element's getter then computes 0u-1 = 0xFFFFFFFF as an index, causing an out-of-bounds heap read roughly 8GB before the buffer. The gdbus CLI tool is specifically called out as vulnerable when parsing a remote service's introspection data. — GNOME GLib issue #3932
• NVD Primary CVSS v3.1 base score is 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H; Red Hat's Secondary score is lower, 7.5 (C:N, DoS-only). Fixed in GLib 2.89.0; backported via dozens of Red Hat RHSA errata. — NVD
• EPSS score is 0.0056 (46.587th percentile) as of 2026-10-30; the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match this run. — FIRST EPSS