CVE-2026-16118 is a heap-based buffer overflow vulnerability in the _xdg_mime_magic_parse_magic_line() function of the xdgmime library (part of glib2). On little-endian systems, incorrect pointer arithmetic during byte-swapping causes a 2-byte out-of-bounds write when parsing attacker-controlled MIME magic files located in user-writable XDG data locations such as $XDG_DATA_HOME/mime/magic. This can result in application crashes or memory corruption. Exploitation requires convincing a user to install a malicious MIME magic file and then processing it with MIME type detection functions like g_content_type_guess(). Red Hat has issued a security advisory and released patched glib2 packages for Red Hat Enterprise Linux 10 and related variants to address this vulnerability.

The vulnerability can cause denial of service via application crashes or memory corruption. Additionally, heap-based buffer overflows may allow execution of arbitrary code by overwriting function pointers or other critical memory structures, potentially compromising system integrity and availability. However, exploitation requires local user interaction to install malicious files and is limited to little-endian systems. The CVSS v3.1 base score is 7.1 (High), reflecting high impact on integrity and availability but no confidentiality impact.

Red Hat has released official patches for this vulnerability in glib2 packages for Red Hat Enterprise Linux 10 and related products. Applying these updates will remediate the issue. Until patched, users should avoid installing MIME magic files or content from untrusted sources in user-writable XDG data locations. No other mitigations are specified by the vendor.