CVE-2026-58013 Details

A buffer over-read vulnerability has been identified in GLib's GIOChannel component. This issue arises in the function g_io_channel_read_line_backend() within the giochannel.c file. When a custom line terminator longer than one byte is used, the memcmp function can read beyond the allocated GString buffer. This flaw may lead to a minor information disclosure of up to 7 bytes or cause a denial-of-service condition if the over-read crosses a page boundary.

To address this vulnerability, it is recommended to limit custom line terminators to a maximum length of one byte when using g_io_channel_set_line_term(). Alternatively, the default line terminators can be used to avoid this issue.