Log in Start free

Vulnerability · Published Jul 17, 2026 · Assigned by redhat

CVE-2026-16118Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

High 7.1

In plain English

A high-severity heap buffer overflow in Cert Manager support for Red Hat OpenShift release 1.17 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10glib22.80.4-12.el10_2.22ALSA-2026:64799
AlmaLinux:8glib22.56.4-178.el8_10ALSA-2026:66451
AlmaLinux:9glib22.68.4-19.el9_8.10ALSA-2026:64800
AlmaLinux:10glib2-devel2.80.4-12.el10_2.22ALSA-2026:64799
AlmaLinux:8glib2-devel2.56.4-178.el8_10ALSA-2026:66451
AlmaLinux:9glib2-devel2.68.4-19.el9_8.10ALSA-2026:64800
AlmaLinux:10glib2-doc2.80.4-12.el10_2.22ALSA-2026:64799
AlmaLinux:8glib2-doc2.56.4-178.el8_10ALSA-2026:66451
AlmaLinux:9glib2-doc2.68.4-19.el9_8.10ALSA-2026:64800
AlmaLinux:8glib2-fam2.56.4-178.el8_10ALSA-2026:66451
AlmaLinux:10glib2-static2.80.4-12.el10_2.22ALSA-2026:64799
AlmaLinux:8glib2-static2.56.4-178.el8_10ALSA-2026:66451
AlmaLinux:9glib2-static2.68.4-19.el9_8.10ALSA-2026:64800
AlmaLinux:10glib2-tests2.80.4-12.el10_2.22ALSA-2026:64799
AlmaLinux:8glib2-tests2.56.4-178.el8_10ALSA-2026:66451
AlmaLinux:9glib2-tests2.68.4-19.el9_8.10ALSA-2026:64800
Debian:12glib2.0no fix listedDEBIAN-CVE-2026-16118
Debian:13glib2.02.84.4-3~deb13u5DEBIAN-CVE-2026-16118
Debian:14glib2.02.88.3-3DEBIAN-CVE-2026-16118
Rocky Linux:10glib20:2.80.4-12.el10_2.22RLSA-2026:64799
Rocky Linux:8glib20:2.56.4-178.el8_10RLSA-2026:66451
Rocky Linux:9glib20:2.68.4-19.el9_8.10RLSA-2026:64800
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.10USN-8794-1
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.10UBUNTU-CVE-2026-16118
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.9USN-8794-1
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.9UBUNTU-CVE-2026-16118
Ubuntu:26.04:LTSglib2.02.88.0-1ubuntu0.1UBUNTU-CVE-2026-16118
Ubuntu:26.04:LTSglib2.02.88.0-1ubuntu0.1USN-8794-1

Affected products (as reported)

VendorProductVersions
xdg xdgmime see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 see references
Red Hat Red Hat AI Inference Server 3.2 see references
Red Hat Red Hat AI Inference Server 3.2 see references
Red Hat Red Hat AI Inference Server 3.2 see references

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References