CVE-2026-58014 is an off-by-one error vulnerability in GLib's g_key_file_get_locale_string_list function (glib/gkeyfile.c). When processing a key file containing an empty value, the function may perform an out-of-bounds memory access by one byte. This can lead to a denial of service if the out-of-bounds access crosses a memory page boundary. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Red Hat advisories RHSA-2026:49512 and RHSA-2026:55440 confirm patches are available for affected GLib packages in Red Hat Enterprise Linux 8 and 9 distributions. The advisories include instructions to update to fixed package versions to mitigate this vulnerability.

Successful exploitation of this off-by-one error can cause an out-of-bounds memory access leading to potential denial of service conditions or limited confidentiality, integrity, and availability impacts. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network. There are no known exploits in the wild at this time. The impact is rated as high due to the possibility of denial of service and partial compromise of confidentiality and integrity.

Official patches addressing CVE-2026-58014 are available from Red Hat as part of security updates for mingw-glib2 (RHEL 8) and glib2 (RHEL 9) packages. Users should apply these updates promptly following the vendor's instructions at https://access.redhat.com/articles/11258. The vendor manages remediation for these packages and no additional mitigations are specified. Patch status is confirmed by the vendor advisories RHSA-2026:49512 and RHSA-2026:55440.