Bug 2433325 (CVE-2026-1485)

Summary: CVE-2026-1485 Glib: Glib: Local denial of service via buffer underflow in content type parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: adudiak, kshier, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2433326, 2433327, 2433328, 2433329, 2433330, 2433331, 2433332, 2433333, 2433334, 2433335, 2433336, 2433337, 2433338, 2433339, 2433340, 2433341, 2433342, 2433343, 2433344, 2433345    
Bug Blocks:    

Description OSIDB Bzimport 2026-01-27 13:13:44 UTC 
Buffer Underflow vulnerability in GLib’s content type parsing logic. The issue is caused by storing the length of a header line in a signed integer, allowing integer wraparound for extremely large inputs. This leads to pointer underflow and out-of-bounds memory access in parse_header(). Exploitation requires a user to install or process a maliciously crafted treemagic file, limiting the practical impact to local denial of service or application instability.