Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
GNOME GLib — Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U L N H 8.2 .0036 29.5 —
AFFECTED
Product Versions Fixed
GLib unspecified —
Red Hat Enterprise Linux 10 unspecified 0:2.80.4-12.el10_2.21
Red Hat Enterprise Linux 8 unspecified 0:2.70.1-9.el8_10
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 10 unspecified —
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
+ 1 more
TIMELINE
Jun 26 Reserved by redhat
Jun 30 EXPLOIT PUBLISHED — CVE-2026-58010 (GNOME GLib). Public exploit reference added.
Jun 30 Published (CNA: redhat)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-58010 (GNOME GLib). Public exploit reference added.
Aug 17 RESCORED — CVE-2026-58010 (GNOME GLib). CVSS 6.5 → 8.2 (NVD).
Description
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
Lifecycle
Complete event history — 5 events, chronological
| Date | Event | Detail |
|---|
| June 26, 2026 | Reserved | Reserved by redhat |
| June 30, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58010 (GNOME GLib). Public exploit reference added. |
| June 30, 2026 | Published | Published (CNA: redhat) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58010 (GNOME GLib). Public exploit reference added. |
| August 17, 2026 | RESCORED | RESCORED — CVE-2026-58010 (GNOME GLib). CVSS 6.5 → 8.2 (NVD). |
Affected
Affected products and packages — 11 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | GLib | — | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:2.80.4-12.el10_2.21 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | 0:2.70.1-9.el8_10 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
| Red Hat | Red Hat Hardened Images | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-58010 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.