Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
GNOME GLib — Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U L L H 8.6 .0032 25.0 —
AFFECTED
Product Versions Fixed
GLib unspecified —
Red Hat Enterprise Linux 10 unspecified 0:2.80.4-12.el10_2.21
Red Hat Enterprise Linux 8 unspecified 0:2.70.1-9.el8_10
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 10 unspecified —
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
+ 1 more
TIMELINE
Jun 26 Reserved by redhat
Jun 30 EXPLOIT PUBLISHED — CVE-2026-58014 (GNOME GLib). Public exploit reference added.
Jun 30 Published (CNA: redhat)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-58014 (GNOME GLib). Public exploit reference added.
Aug 17 RESCORED — CVE-2026-58014 (GNOME GLib). CVSS 7.3 → 8.6 (NVD).
Description
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Lifecycle
Complete event history — 5 events, chronological
| Date | Event | Detail |
|---|
| June 26, 2026 | Reserved | Reserved by redhat |
| June 30, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58014 (GNOME GLib). Public exploit reference added. |
| June 30, 2026 | Published | Published (CNA: redhat) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58014 (GNOME GLib). Public exploit reference added. |
| August 17, 2026 | RESCORED | RESCORED — CVE-2026-58014 (GNOME GLib). CVSS 7.3 → 8.6 (NVD). |
Affected
Affected products and packages — 11 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | GLib | — | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:2.80.4-12.el10_2.21 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | 0:2.70.1-9.el8_10 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
| Red Hat | Red Hat Hardened Images | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-58014 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.