CVE-2026-58014 Details

A vulnerability exists in GLib due to an off-by-one error in the 'g_key_file_get_locale_string_list' function within 'gkeyfile.c'. This error can occur when a key file is loaded with an empty value, causing an out-of-bounds access of one byte. The issue can lead to a heap buffer under-read, where the program reads memory before a allocated heap buffer, potentially causing a crash or resource consumption. The vulnerability affects all GLib versions since 'g_key_file_get_locale_string_list' was introduced, and is present in several Red Hat Enterprise Linux versions.

To address this vulnerability, input validation should be implemented to sanitize untrusted key files, such as.desktop or.ini files, by rejecting or removing empty values before they are processed by 'g_key_file_get_locale_string_list'. Alternatively, applications can be restricted to load key files only from trusted sources.