CVE-2026-58013 describes a buffer over-read in GLib's g_io_channel_read_line_backend() function within giochannel.c. When a custom line terminator with length greater than one is set, the memcmp operation reads past the end of the GString buffer, causing an out-of-bounds read. This can result in minor information disclosure (7 bytes) or a denial of service if the read crosses a page boundary. The vulnerability affects GLib versions before 2.70.1. Red Hat has issued a security advisory (RHSA-2026:49512) providing patches for affected products.

The vulnerability can lead to a minor information disclosure of 7 bytes or cause a denial of service condition if the buffer over-read crosses a memory page boundary. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, limited confidentiality impact, no integrity impact, and low availability impact.

A security update fixing this vulnerability is available and should be applied. Red Hat has released an advisory (RHSA-2026:49512) with patches for affected GLib versions. Users should update to GLib version 2.70.1 or later where this issue is resolved. No additional mitigation actions are indicated by the vendor advisory.