Vulnerability · Published Jan 27, 2026 · Assigned by redhat
CVE-2026-1485Glib: glib: local denial of service via buffer underflow in content type parsing
Low 2.8
In plain English
A low-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glib2.0 | 2.74.6-2+deb12u9 | DEBIAN-CVE-2026-1485 |
| Debian:13 | glib2.0 | 2.84.4-3~deb13u3 | DEBIAN-CVE-2026-1485 |
| Debian:14 | glib2.0 | 2.86.3-5 | DEBIAN-CVE-2026-1485 |
| Ubuntu:22.04:LTS | glib2.0 | 2.72.4-0ubuntu2.9 | USN-8017-1 |
| Ubuntu:22.04:LTS | glib2.0 | 2.72.4-0ubuntu2.9 | UBUNTU-CVE-2026-1485 |
| Ubuntu:24.04:LTS | glib2.0 | 2.80.0-6ubuntu3.8 | USN-8017-1 |
| Ubuntu:24.04:LTS | glib2.0 | 2.80.0-6ubuntu3.8 | UBUNTU-CVE-2026-1485 |
| Ubuntu:25.10 | glib2.0 | 2.86.0-2ubuntu0.3 | UBUNTU-CVE-2026-1485 |
| Ubuntu:25.10 | glib2.0 | 2.86.0-2ubuntu0.3 | USN-8017-1 |
| Ubuntu:26.04:LTS | glib2.0 | 2.87.2-2 | UBUNTU-CVE-2026-1485 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-124 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-1485 vdb-entry, x_refsource_REDHAT
- RHBZ#2433325 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/glib/-/issues/3871