CVE-2026-58013 is a buffer over-read vulnerability in the GLib library, specifically in the g_io_channel_read_line_backend() function within giochannel.c. When a custom line terminator string longer than one byte is set using g_io_channel_set_line_term(), the memcmp operation in g_io_channel_read_line_backend() may read beyond the allocated GString buffer. This can result in an information disclosure of up to 7 bytes or a denial of service due to application crash if the over-read crosses an unmapped memory page boundary. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact. Red Hat's advisory confirms the issue and recommends restricting custom line terminators to a maximum length of one byte or using default terminators to neutralize the vulnerability. No official patch version is explicitly stated in the provided data, but Red Hat has issued security updates including this fix in mingw-glib2 packages for Red Hat Enterprise Linux 8.

Exploitation of this vulnerability can lead to minor information disclosure of 7 bytes from out-of-bounds memory or cause a denial of service via application crash when the buffer over-read crosses a page boundary. The information disclosure may aid attackers in bypassing protection mechanisms such as ASLR. The denial of service impact is considered low as crashes are reliably reproducible in AddressSanitizer builds but not commonly in production environments.

To mitigate this vulnerability, applications should restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators completely neutralizes the issue. Additionally, Red Hat has released security updates for affected packages (e.g., mingw-glib2 for RHEL 8) that address this vulnerability. Applying these official updates is recommended where applicable. Patch status is confirmed via Red Hat advisory; users should consult vendor advisories for update availability and instructions.