Alpine: glib: security update to 2.86.4-r0

critical Tenable Cloud Security Plugin ID 478651

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the
gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a
`node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can
cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
(CVE-2026-58016)

- A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the
glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses >
instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information
disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
(CVE-2026-58010)

- A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd
function in the glib/gdatetime.c file when an invalid GDateTime object produced by the
g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause
logic errors that may lead to a denial of service. (CVE-2026-58011)

- A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the
`G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function
processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is
treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a
denial of service when the buffer over-read crosses a page boundary. (CVE-2026-58012)

- A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the
giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to
read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a
denial of service when the buffer over-read crosses a page boundary. (CVE-2026-58013)

Solution

Update the glib library and its related packages to version 2.86.4-r0 or later.

Plugin Details

Severity: Critical

ID: 478651

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 11/8/2026

Updated: 11/8/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

Percentile: 95.85

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-58016

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/30/2026

Reference Information

CVE: CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58016

IAVA: 2026-A-0684

Detections

Analytics