Vulnerability record/PUBLISHED/Published Jan 27, 2026 14:26:47 UTC
CVE-2026-1489
A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.
Base score5.4/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactLowI
Availability impactLowA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 6, 2026 07:51:43 UTC
PublishedJan 27, 2026 14:26:47 UTC
ReservedJan 27, 2026 14:00:10 UTC
Credits
- Red Hat would like to thank treeplus for reporting this issue.