The vulnerability CVE-2026-58014 in GNOME GLib arises from an off-by-one error in the g_key_file_get_locale_string_list function in gkeyfile.c. When processing key files containing empty values, this flaw can cause an out-of-bounds access of one byte, which may lead to a denial of service if the access crosses a memory page boundary. The issue primarily affects applications that load or parse untrusted key files, such as .desktop or .ini files. Red Hat's advisory notes that the vulnerability can cause application crashes and is rated with moderate severity due to the limited impact in production environments. Mitigation includes sanitizing input key files to reject or strip empty values or restricting key file loading to trusted sources. Red Hat has released security updates for affected packages, including mingw-glib2 for Red Hat Enterprise Linux 8.

The vulnerability can cause an out-of-bounds memory access of one byte, which may lead to application crashes resulting in denial of service. The crash is reliably reproducible in AddressSanitizer (ASan) builds but less so in production environments. The impact includes potential low confidentiality, integrity, and availability effects, with the primary concern being denial of service through application instability. There is no evidence of known exploits in the wild. The vulnerability affects applications that load untrusted key files, potentially causing crashes when processing empty values in such files.

Red Hat advises implementing input validation to sanitize untrusted key files by rejecting or stripping empty values before invoking g_key_file_get_locale_string_list(). Alternatively, restricting applications to load key files only from trusted sources will fully mitigate the vulnerability. Red Hat has released security updates addressing this issue; applying these official patches is the recommended remediation. Users should refer to the Red Hat advisory RHSA-2026:49512 for details on applying the update. No further action is required if the update is applied.