CVE-2026-58016 Details

A state confusion vulnerability has been identified in GLib's D-Bus introspection XML processing. The issue arises in the function g_dbus_node_info_new_for_xml() within the gio/gdbusintrospection.c file. When the parser encounters malformed XML with <node> elements improperly nested inside <method>, <signal>, <property>, or <arg> elements, it creates an inconsistent internal state. This flaw can cause an unsigned integer underflow, leading to an out-of-bounds heap read, and ultimately, a denial-of-service condition.

Users can update to GLib version 2.89.0 or later, where this vulnerability has been fixed. For applications that cannot be updated, it is recommended to implement input validation to sanitize D-Bus introspection XML from untrusted sources, rejecting malformed structures before processing them with g_dbus_node_info_new_for_xml().