Bug 2492245 (CVE-2026-58011)

Summary: CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kshier, rhel-process-autobot, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2494870, 2494871, 2494872    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-24 16:41:06 UTC
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_get_year()) is subsequently called, the internal g_date_time_get_ymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.

Comment 3 errata-xmlrpc 2026-08-03 01:47:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:49512 https://access.redhat.com/errata/RHSA-2026:49512

Comment 4 errata-xmlrpc 2026-08-17 05:48:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55440 https://access.redhat.com/errata/RHSA-2026:55440

Comment 5 errata-xmlrpc 2026-08-19 16:42:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:57015 https://access.redhat.com/errata/RHSA-2026:57015

Comment 6 errata-xmlrpc 2026-08-31 19:29:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:61766 https://access.redhat.com/errata/RHSA-2026:61766

Comment 7 errata-xmlrpc 2026-09-09 02:26:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:65762 https://access.redhat.com/errata/RHSA-2026:65762

Comment 8 errata-xmlrpc 2026-09-09 02:59:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:65771 https://access.redhat.com/errata/RHSA-2026:65771

Comment 9 errata-xmlrpc 2026-09-09 02:59:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:65767 https://access.redhat.com/errata/RHSA-2026:65767

Comment 10 errata-xmlrpc 2026-09-09 03:04:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:65769 https://access.redhat.com/errata/RHSA-2026:65769

Comment 11 errata-xmlrpc 2026-09-09 03:09:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:65763 https://access.redhat.com/errata/RHSA-2026:65763

Comment 12 errata-xmlrpc 2026-09-09 03:14:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:65773 https://access.redhat.com/errata/RHSA-2026:65773

Comment 13 errata-xmlrpc 2026-09-09 03:27:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:65768 https://access.redhat.com/errata/RHSA-2026:65768

Comment 14 errata-xmlrpc 2026-09-09 03:28:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:65770 https://access.redhat.com/errata/RHSA-2026:65770