Vulnerability-Lookup

ubuntu-cve-2026-1485

Vulnerability from osv_ubuntu

Published

2026-01-27 14:15

Modified

2026-05-20 15:24

Summary

Details

A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.

Severity

2.8 (Low)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-1485	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-1485	REPORT
	https://access.redhat.com/security/cve/CVE-2026-1485	REPORT
	https://ubuntu.com/security/notices/USN-8017-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libglib2.0-0",
            "binary_version": "2.40.2-0ubuntu1.1+esm7"
          },
          {
            "binary_name": "libglib2.0-0-refdbg",
            "binary_version": "2.40.2-0ubuntu1.1+esm7"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.40.2-0ubuntu1.1+esm7"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.40.2-0ubuntu1.1+esm7"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.40.2-0ubuntu1.1+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.40.2-0ubuntu1.1+esm7?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.38.0-1ubuntu1",
        "2.38.1-1",
        "2.39.1-0ubuntu1",
        "2.39.1-0ubuntu2",
        "2.39.1-0ubuntu3",
        "2.39.2-0ubuntu1",
        "2.39.2-0ubuntu2",
        "2.39.3-0ubuntu4",
        "2.39.4-0ubuntu1",
        "2.39.90-0ubuntu1",
        "2.39.91-0ubuntu2",
        "2.39.91-0ubuntu3",
        "2.39.92-2",
        "2.40.0-1",
        "2.40.0-1ubuntu1",
        "2.40.0-2",
        "2.40.2-0ubuntu1",
        "2.40.2-0ubuntu1.1",
        "2.40.2-0ubuntu1.1+esm1",
        "2.40.2-0ubuntu1.1+esm2",
        "2.40.2-0ubuntu1.1+esm3",
        "2.40.2-0ubuntu1.1+esm4",
        "2.40.2-0ubuntu1.1+esm6",
        "2.40.2-0ubuntu1.1+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libglib2.0-0",
            "binary_version": "2.48.2-0ubuntu4.8+esm5"
          },
          {
            "binary_name": "libglib2.0-0-refdbg",
            "binary_version": "2.48.2-0ubuntu4.8+esm5"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.48.2-0ubuntu4.8+esm5"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.48.2-0ubuntu4.8+esm5"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.48.2-0ubuntu4.8+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.48.2-0ubuntu4.8+esm5?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.46.1-1",
        "2.46.1-2",
        "2.47.1-1",
        "2.47.3-3",
        "2.47.4-1",
        "2.47.5-1",
        "2.47.6-1",
        "2.48.0-1ubuntu3",
        "2.48.0-1ubuntu4",
        "2.48.1-1~ubuntu16.04.1",
        "2.48.2-0ubuntu1",
        "2.48.2-0ubuntu3",
        "2.48.2-0ubuntu4",
        "2.48.2-0ubuntu4.1",
        "2.48.2-0ubuntu4.2",
        "2.48.2-0ubuntu4.3",
        "2.48.2-0ubuntu4.4",
        "2.48.2-0ubuntu4.5",
        "2.48.2-0ubuntu4.6",
        "2.48.2-0ubuntu4.7",
        "2.48.2-0ubuntu4.8",
        "2.48.2-0ubuntu4.8+esm1",
        "2.48.2-0ubuntu4.8+esm3",
        "2.48.2-0ubuntu4.8+esm4",
        "2.48.2-0ubuntu4.8+esm5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libglib2.0-0",
            "binary_version": "2.56.4-0ubuntu0.18.04.9+esm5"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.56.4-0ubuntu0.18.04.9+esm5"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.56.4-0ubuntu0.18.04.9+esm5"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.56.4-0ubuntu0.18.04.9+esm5"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.56.4-0ubuntu0.18.04.9+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.56.4-0ubuntu0.18.04.9+esm5?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.54.1-1ubuntu1",
        "2.55.2-2ubuntu1",
        "2.56.0-2ubuntu1",
        "2.56.0-4ubuntu1",
        "2.56.1-2ubuntu1",
        "2.56.2-0ubuntu0.18.04.1",
        "2.56.2-0ubuntu0.18.04.2",
        "2.56.3-0ubuntu0.18.04.1",
        "2.56.4-0ubuntu0.18.04.2",
        "2.56.4-0ubuntu0.18.04.3",
        "2.56.4-0ubuntu0.18.04.4",
        "2.56.4-0ubuntu0.18.04.5",
        "2.56.4-0ubuntu0.18.04.6",
        "2.56.4-0ubuntu0.18.04.7",
        "2.56.4-0ubuntu0.18.04.8",
        "2.56.4-0ubuntu0.18.04.9",
        "2.56.4-0ubuntu0.18.04.9+esm3",
        "2.56.4-0ubuntu0.18.04.9+esm4",
        "2.56.4-0ubuntu0.18.04.9+esm5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libglib2.0-0",
            "binary_version": "2.64.6-1~ubuntu20.04.9+esm1"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.64.6-1~ubuntu20.04.9+esm1"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.64.6-1~ubuntu20.04.9+esm1"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.64.6-1~ubuntu20.04.9+esm1"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.64.6-1~ubuntu20.04.9+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.64.6-1~ubuntu20.04.9+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.62.1-1",
        "2.63.1-2",
        "2.63.1-2ubuntu1",
        "2.63.3-1",
        "2.63.3-3",
        "2.63.5-2",
        "2.64.0-1",
        "2.64.1-1",
        "2.64.2-1~fakesync1",
        "2.64.3-1~ubuntu20.04.1",
        "2.64.6-1~ubuntu20.04.1",
        "2.64.6-1~ubuntu20.04.2",
        "2.64.6-1~ubuntu20.04.3",
        "2.64.6-1~ubuntu20.04.4",
        "2.64.6-1~ubuntu20.04.6",
        "2.64.6-1~ubuntu20.04.7",
        "2.64.6-1~ubuntu20.04.8",
        "2.64.6-1~ubuntu20.04.9",
        "2.64.6-1~ubuntu20.04.9+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libglib2.0-0",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.72.4-0ubuntu2.9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.72.4-0ubuntu2.9?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.72.4-0ubuntu2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.68.4-1ubuntu1",
        "2.70.1-1",
        "2.70.2-1",
        "2.71.0-2",
        "2.71.1-1",
        "2.71.2-1",
        "2.71.3-1",
        "2.72.0-1",
        "2.72.1-1",
        "2.72.4-0ubuntu1",
        "2.72.4-0ubuntu2",
        "2.72.4-0ubuntu2.2",
        "2.72.4-0ubuntu2.3",
        "2.72.4-0ubuntu2.4",
        "2.72.4-0ubuntu2.5",
        "2.72.4-0ubuntu2.6",
        "2.72.4-0ubuntu2.7",
        "2.72.4-0ubuntu2.8"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-girepository-3.0",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "gir1.2-glib-2.0",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libgirepository-2.0-0",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-0t64",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.80.0-6ubuntu3.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.80.0-6ubuntu3.8?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.80.0-6ubuntu3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.78.0-2",
        "2.78.1-4",
        "2.78.3-1",
        "2.78.3-2",
        "2.79.1-1",
        "2.79.2-1~ubuntu1",
        "2.79.3-3ubuntu5",
        "2.80.0-6ubuntu1",
        "2.80.0-6ubuntu3",
        "2.80.0-6ubuntu3.1",
        "2.80.0-6ubuntu3.2",
        "2.80.0-6ubuntu3.4",
        "2.80.0-6ubuntu3.5",
        "2.80.0-6ubuntu3.6",
        "2.80.0-6ubuntu3.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-girepository-3.0",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "gir1.2-glib-2.0",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "girepository-tools",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libgio-2.0-dev-bin",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libgirepository-2.0-0",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-0t64",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.86.0-2ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.86.0-2ubuntu0.3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.86.0-2ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.84.1-1",
        "2.84.1-2",
        "2.84.2-1",
        "2.84.3-1",
        "2.85.1-2",
        "2.85.2-2",
        "2.85.3-1",
        "2.86.0-2",
        "2.86.0-2ubuntu0.1",
        "2.86.0-2ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-girepository-3.0",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "gir1.2-glib-2.0",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "girepository-tools",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libgio-2.0-dev-bin",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libgirepository-2.0-0",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libglib2.0-0t64",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.87.2-2"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.87.2-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.87.2-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.87.2-2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.86.0-2",
        "2.86.1-1",
        "2.86.1-2",
        "2.86.2-1",
        "2.86.3-1",
        "2.86.3-4"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in Glib\u0027s content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.",
  "id": "UBUNTU-CVE-2026-1485",
  "modified": "2026-05-20T15:24:27Z",
  "published": "2026-01-27T14:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-1485"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1485"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-1485"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8017-1"
    }
  ],
  "related": [
    "USN-8017-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-1485"
  ]
}

CVE-2026-1485 (GCVE-0-2026-1485)

Vulnerability from cvelistv5 – Published: 2026-01-27 13:43 – Updated: 2026-03-18 16:44

Title

Glib: glib: local denial of service via buffer underflow in content type parsing

Summary

Severity

2.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-124 - Buffer Underwrite ('Buffer Underflow')

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-1485	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2433325	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/glib/-/issues/3871

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-01-27 00:00

Credits

Red Hat would like to thank treeplus for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1485",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T14:39:59.509071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T14:42:44.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "bootc",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glycin-loaders",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "loupe",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "papers",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm-ostree",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "bootc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank treeplus for reporting this issue."
        }
      ],
      "datePublic": "2026-01-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Glib\u0027s content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T16:44:23.593Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1485"
        },
        {
          "name": "RHBZ#2433325",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-27T12:55:34.373Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-27T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Glib: glib: local denial of service via buffer underflow in content type parsing",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-124: Buffer Underwrite (\u0027Buffer Underflow\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-1485",
    "datePublished": "2026-01-27T13:43:18.098Z",
    "dateReserved": "2026-01-27T12:56:50.801Z",
    "dateUpdated": "2026-03-18T16:44:23.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-8017-1

Vulnerability from osv_ubuntu

Published

2026-02-05 13:12

Modified

2026-04-27 14:11

Summary

glib2.0 vulnerabilities

Details

It was discovered that GLib incorrectly parsed large Base64 data. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-1484)

It was discovered that GLib incorrectly parsed certain treemagic files. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-1485)

It was discovered that GLib incorrectly handled Unicode case conversion. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-1489)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8017-1	ADVISORY
	https://ubuntu.com/security/CVE-2026-1484	REPORT
	https://ubuntu.com/security/CVE-2026-1485	REPORT
	https://ubuntu.com/security/CVE-2026-1489	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-1484",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1485",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1489",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libglib2.0-0",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.72.4-0ubuntu2.9"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.72.4-0ubuntu2.9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.72.4-0ubuntu2.9?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.72.4-0ubuntu2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.68.4-1ubuntu1",
        "2.70.1-1",
        "2.70.2-1",
        "2.71.0-2",
        "2.71.1-1",
        "2.71.2-1",
        "2.71.3-1",
        "2.72.0-1",
        "2.72.1-1",
        "2.72.4-0ubuntu1",
        "2.72.4-0ubuntu2",
        "2.72.4-0ubuntu2.2",
        "2.72.4-0ubuntu2.3",
        "2.72.4-0ubuntu2.4",
        "2.72.4-0ubuntu2.5",
        "2.72.4-0ubuntu2.6",
        "2.72.4-0ubuntu2.7",
        "2.72.4-0ubuntu2.8"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-1484",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1485",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1489",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-girepository-3.0",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "gir1.2-glib-2.0",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libgirepository-2.0-0",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-0t64",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.80.0-6ubuntu3.8"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.80.0-6ubuntu3.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.80.0-6ubuntu3.8?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.80.0-6ubuntu3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.78.0-2",
        "2.78.1-4",
        "2.78.3-1",
        "2.78.3-2",
        "2.79.1-1",
        "2.79.2-1~ubuntu1",
        "2.79.3-3ubuntu5",
        "2.80.0-6ubuntu1",
        "2.80.0-6ubuntu3",
        "2.80.0-6ubuntu3.1",
        "2.80.0-6ubuntu3.2",
        "2.80.0-6ubuntu3.4",
        "2.80.0-6ubuntu3.5",
        "2.80.0-6ubuntu3.6",
        "2.80.0-6ubuntu3.7"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-1484",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1485",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-1489",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:25.10"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-girepository-3.0",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "gir1.2-glib-2.0",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "girepository-tools",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libgio-2.0-dev-bin",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libgirepository-2.0-0",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-0t64",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-bin",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-data",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-dev-bin",
            "binary_version": "2.86.0-2ubuntu0.3"
          },
          {
            "binary_name": "libglib2.0-tests",
            "binary_version": "2.86.0-2ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "glib2.0",
        "purl": "pkg:deb/ubuntu/glib2.0@2.86.0-2ubuntu0.3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.86.0-2ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.84.1-1",
        "2.84.1-2",
        "2.84.2-1",
        "2.84.3-1",
        "2.85.1-2",
        "2.85.2-2",
        "2.85.3-1",
        "2.86.0-2",
        "2.86.0-2ubuntu0.1",
        "2.86.0-2ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that GLib incorrectly parsed large Base64 data. An\nattacker could use this issue to cause GLib to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2026-1484)\n\nIt was discovered that GLib incorrectly parsed certain treemagic files.\nAn attacker could use this issue to cause GLib to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2026-1485)\n\nIt was discovered that GLib incorrectly handled Unicode case conversion.\nAn attacker could use this issue to cause GLib to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2026-1489)",
  "id": "USN-8017-1",
  "modified": "2026-04-27T14:11:47Z",
  "published": "2026-02-05T13:12:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8017-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-1484"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-1485"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-1489"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "glib2.0 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2026-1484",
    "UBUNTU-CVE-2026-1485",
    "UBUNTU-CVE-2026-1489"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2026-1485

Vulnerability from osv_ubuntu

CVE-2026-1485 (GCVE-0-2026-1485)

usn-8017-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature