Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
mingw-glib2: Multiple Security Risks in Parsing and Data Handling
published 3 months ago
Summary
The mingw-glib2 library has several security issues that can cause crashes or allow attackers to execute malicious code. These issues affect how the library handles and parses data, which can lead to serious security risks. It's recommended to update the library to the latest version to fix these issues.
What to do
- Update almalinux mingw32-glib2 to version 2.70.1-9.el8_10.
- Update almalinux mingw32-glib2-static to version 2.70.1-9.el8_10.
- Update almalinux mingw64-glib2 to version 2.70.1-9.el8_10.
- Update almalinux mingw64-glib2-static to version 2.70.1-9.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | mingw32-glib2 |
< 2.70.1-9.el8_10 Fix: upgrade to 2.70.1-9.el8_10
|
| AlmaLinux:8 | almalinux | mingw32-glib2-static |
< 2.70.1-9.el8_10 Fix: upgrade to 2.70.1-9.el8_10
|
| AlmaLinux:8 | almalinux | mingw64-glib2 |
< 2.70.1-9.el8_10 Fix: upgrade to 2.70.1-9.el8_10
|
| AlmaLinux:8 | almalinux | mingw64-glib2-static |
< 2.70.1-9.el8_10 Fix: upgrade to 2.70.1-9.el8_10
|
Original advisory text
Important: mingw-glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.
Security Fix(es):
* glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
* glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010)
* glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011)
* glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012)
* glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013)
* glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014)
* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
* glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
* glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010)
* glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011)
* glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012)
* glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013)
* glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014)
* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
* glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:49512 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-14087 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58010 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58011 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58012 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58013 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58014 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58015 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-58016 Third Party Advisory
- https://bugzilla.redhat.com/2419093 Third Party Advisory
- https://bugzilla.redhat.com/2492243 Third Party Advisory
- https://bugzilla.redhat.com/2492245 Third Party Advisory
- https://bugzilla.redhat.com/2492247 Third Party Advisory
- https://bugzilla.redhat.com/2492248 Third Party Advisory
- https://bugzilla.redhat.com/2492255 Third Party Advisory
- https://bugzilla.redhat.com/2492256 Third Party Advisory
- https://bugzilla.redhat.com/2492257 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-49512.html Vendor Advisory
Timeline
Published3 Aug 2026
Updated3 Aug 2026
First seen3 Aug 2026
Sources
ALSA-2026:49512 · OSV
Track software like this
Free during beta