Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
GLib Unicode Conversion Can Crash Software
published 7 months ago
Summary
A security update is available for GLib, a set of essential system libraries. If an attacker sends very large and specially crafted text to a software that uses GLib for text conversion, it could crash or become unstable. Users should update their GLib software to the latest version to prevent this vulnerability.
What to do
- Update openeuler glib2 to version 2.66.8-24.oe2003sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:20.03-LTS-SP4 | openeuler | glib2 |
< 2.66.8-24.oe2003sp4 Fix: upgrade to 2.66.8-24.oe2003sp4
|
Original advisory text
glib2 security update
GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib&apos;s code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.
Security Fix(es):
A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable. This vulnerability has an impact on confidentiality, integrity, and availability.(CVE-2026-1489)
Security Fix(es):
A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable. This vulnerability has an impact on confidentiality, integrity, and availability.(CVE-2026-1489)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-1489 Vendor Advisory
Severity
5.4
Medium
Timeline
Published20 Mar 2026
Updated18 Aug 2026
First seen20 Mar 2026
Sources
OESA-2026-1683 · OSV
Track software like this
Free during beta