{"id":"CVE-2026-1485","title":"Glib: glib: local denial of service via buffer underflow in content type parsing","summary":"A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results…","severity":"low","cvss":2.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-124"],"vendor":"Red Hat","product":"bootc","affected":["bootc (all versions)","glib2 (all versions)","glycin-loaders (all versions)","loupe (all versions)","mingw-glib2 (all versions)","papers (all versions)","rpm-ostree (all versions)","glib2 (all versions)","glib2 (all versions)","glib2 (all versions)","librsvg2 (all versions)","mingw-glib2 (all versions)","bootc (all versions)","glib2 (all versions)","librsvg2 (all versions)","mingw-glib2 (all versions)","rhoai/odh-ai-gateway-operator-rhel9","rhoai/odh-core-bff-rhel9","rhoai/odh-dashboard-operator-rhel9","rhoai/odh-dashboard-rhel9","rhoai/odh-data-science-pipelines-operator-controller-rhel9","rhoai/odh-kf-notebook-controller-rhel9","rhoai/odh-kserve-controller-rhel9","rhoai/odh-kserve-llmisvc-controller-rhel9","rhoai/odh-kserve-module-operator-rhel9","rhoai/odh-kuberay-operator-controller-rhel9","rhoai/odh-kube-rbac-proxy-rhel9","rhoai/odh-llama-stack-k8s-operator-rhel9","rhoai/odh-maas-controller-rhel9","rhoai/odh-mlflow-operator-rhel9","rhoai/odh-mlflow-rhel9","rhoai/odh-mod-arch-agent-ops-rhel9","rhoai/odh-mod-arch-automl-rhel9","rhoai/odh-mod-arch-autorag-rhel9","rhoai/odh-mod-arch-eval-hub-rhel9","rhoai/odh-mod-arch-gen-ai-rhel9","rhoai/odh-mod-arch-maas-rhel9","rhoai/odh-mod-arch-mlflow-rhel9","rhoai/odh-mod-arch-model-registry-rhel9","rhoai/odh-model-controller-rhel9","rhoai/odh-model-registry-operator-rhel9","rhoai/odh-model-serving-api-rhel9","rhoai/odh-notebook-controller-rhel9","rhoai/odh-ogx-k8s-operator-rhel9","rhoai/odh-ogx-module-operator-rhel9","rhoai/odh-training-operator-rhel9","rhoai/odh-trustyai-service-operator-rhel9","rhoai/odh-workbenches-operator-rhel9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-01-27T14:39:59.509071Z"},"published":"2026-01-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:53:47.196Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-1485","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-1485"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433325","label":"RHBZ#2433325"},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/3871"}],"tags":["cve.org"],"epss":0.00156,"epssPercentile":0.04767,"ingestedAt":"2026-11-06T18:00:12.496Z","slug":"CVE-2026-1485","body":"## Overview\n\nA flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.\n\n## Affected\n\n- `bootc (all versions)`\n- `glib2 (all versions)`\n- `glycin-loaders (all versions)`\n- `loupe (all versions)`\n- `mingw-glib2 (all versions)`\n- `papers (all versions)`\n- `rpm-ostree (all versions)`\n- `glib2 (all versions)`\n- `glib2 (all versions)`\n- `glib2 (all versions)`\n- `librsvg2 (all versions)`\n- `mingw-glib2 (all versions)`\n- `bootc (all versions)`\n- `glib2 (all versions)`\n- `librsvg2 (all versions)`\n- `mingw-glib2 (all versions)`\n- `rhoai/odh-ai-gateway-operator-rhel9`\n- `rhoai/odh-core-bff-rhel9`\n- `rhoai/odh-dashboard-operator-rhel9`\n- `rhoai/odh-dashboard-rhel9`\n- `rhoai/odh-data-science-pipelines-operator-controller-rhel9`\n- `rhoai/odh-kf-notebook-controller-rhel9`\n- `rhoai/odh-kserve-controller-rhel9`\n- `rhoai/odh-kserve-llmisvc-controller-rhel9`\n- `rhoai/odh-kserve-module-operator-rhel9`\n- `rhoai/odh-kuberay-operator-controller-rhel9`\n- `rhoai/odh-kube-rbac-proxy-rhel9`\n- `rhoai/odh-llama-stack-k8s-operator-rhel9`\n- `rhoai/odh-maas-controller-rhel9`\n- `rhoai/odh-mlflow-operator-rhel9`\n- `rhoai/odh-mlflow-rhel9`\n- `rhoai/odh-mod-arch-agent-ops-rhel9`\n- `rhoai/odh-mod-arch-automl-rhel9`\n- `rhoai/odh-mod-arch-autorag-rhel9`\n- `rhoai/odh-mod-arch-eval-hub-rhel9`\n- `rhoai/odh-mod-arch-gen-ai-rhel9`\n- `rhoai/odh-mod-arch-maas-rhel9`\n- `rhoai/odh-mod-arch-mlflow-rhel9`\n- `rhoai/odh-mod-arch-model-registry-rhel9`\n- `rhoai/odh-model-controller-rhel9`\n- `rhoai/odh-model-registry-operator-rhel9`\n- `rhoai/odh-model-serving-api-rhel9`\n- `rhoai/odh-notebook-controller-rhel9`\n- `rhoai/odh-ogx-k8s-operator-rhel9`\n- `rhoai/odh-ogx-module-operator-rhel9`\n- `rhoai/odh-training-operator-rhel9`\n- `rhoai/odh-trustyai-service-operator-rhel9`\n- `rhoai/odh-workbenches-operator-rhel9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":15.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}