The vulnerability CVE-2026-58014 is an off-by-one error in the GLib library's g_key_file_get_locale_string_list function within gkeyfile.c. When a key file containing an empty value is loaded, this flaw can cause a 1-byte out-of-bounds memory access, which may lead to a denial of service if the access crosses a page boundary. This affects applications that parse untrusted key files, typically .desktop or .ini files. The issue can cause application crashes due to undefined behavior from the out-of-bounds access. Red Hat's advisory notes that the vulnerability can be mitigated by sanitizing input to reject or strip empty values before calling the vulnerable function or by restricting key file loading to trusted sources. Red Hat has released security updates for affected packages, including mingw-glib2 for Red Hat Enterprise Linux 8. The CVSS v3.1 base score is 7.3 (high severity) with network attack vector, low attack complexity, no privileges required, and impacts on confidentiality, integrity, and availability rated as low.

The vulnerability can cause an out-of-bounds memory access of one byte, potentially leading to application crashes or denial of service if the access crosses a page boundary. This results in instability and possible resource consumption issues. The impact on confidentiality and integrity is low, but the denial of service impact is rated low to moderate depending on environment. There are no known exploits in the wild. The vulnerability affects applications that load or parse untrusted key files, which could be leveraged to cause crashes or service interruptions.

Red Hat advises mitigating this vulnerability by implementing input validation to sanitize untrusted key files, specifically rejecting or stripping empty values before invoking g_key_file_get_locale_string_list(). Alternatively, restricting applications to load key files only from trusted sources will fully neutralize the issue. Red Hat has released security updates addressing this vulnerability; applying these official fixes is recommended. Patch status is confirmed as fixed in updated Red Hat packages. Users should refer to Red Hat advisories and apply the available updates accordingly.