Bug 2429886 (CVE-2026-0988)

Summary: CVE-2026-0988 glib: GLib: Denial of Service via Integer Overflow in g_buffered_input_stream_peek()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: kshier, rhel-process-autobot, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2429888, 2429889, 2429890, 2429891, 2429892, 2429893, 2429894, 2429895, 2429896, 2429897, 2429898, 2429899, 2429900, 2429901, 2429902, 2429903, 2429904, 2429905, 2429906, 2429907, 2429908, 2429909, 2429910, 2429911, 2429912, 2429913, 2429914, 2429915, 2429916, 2429917, 2429918, 2429919, 2429920, 2429921, 2429922, 2429923    
Bug Blocks:    

Description OSIDB Bzimport 2026-01-15 11:26:11 UTC 
Integer Overflow vulnerability in the g_buffered_input_stream_peek() function of the GLib library. The issue is caused by missing validation of the offset and count parameters, leading to an unsafe arithmetic operation during length calculation. When specially crafted values are provided, the offset + count computation may overflow, resulting in an incorrect size being passed to memcpy(). This can trigger a heap or stack buffer overflow and lead to a segmentation fault. Exploitation is subject to strict preconditions and primarily impacts availability by causing application crashes.