CVE catalog

CVE-2026-1489

GLib vulnerabilities

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglib2.0sid2.90.1-2fixed
Debianglib2.0forky2.90.1-2fixed
Debianglib2.0trixie2.84.4-3~deb13u5fixed
Debianglib2.0bookworm2.74.6-2+deb12u9fixed
Debianglib2.0bookworm-security2.74.6-2+deb12u2vulnerable
Ubuntuglib2.0nobleNot reportedvulnerable
Ubuntuglib2.0noble2.80.0-6ubuntu3.8fixed
Ubuntugir1.2-girepository-3.0noble2.80.0-6ubuntu3.8fixed
Ubuntugir1.2-girepository-3.0-devnoble2.80.0-6ubuntu3.8fixed
Ubuntugir1.2-glib-2.0noble2.80.0-6ubuntu3.8fixed
Ubuntugir1.2-glib-2.0-devnoble2.80.0-6ubuntu3.8fixed
Ubuntulibgirepository-2.0-0noble2.80.0-6ubuntu3.8fixed
Ubuntulibgirepository-2.0-devnoble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-0t64noble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-binnoble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-datanoble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-devnoble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-dev-binnoble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-docnoble2.80.0-6ubuntu3.8fixed
Ubuntulibglib2.0-testsnoble2.80.0-6ubuntu3.8fixed
Ubuntuglib2.0pro2.62.1-1vulnerable
Ubuntuglib2.0pro2.63.1-2vulnerable
Ubuntuglib2.0pro2.63.1-2ubuntu1vulnerable
Ubuntuglib2.0pro2.63.3-1vulnerable
Ubuntuglib2.0pro2.63.3-3vulnerable
Ubuntuglib2.0pro2.63.5-2vulnerable
Ubuntuglib2.0pro2.64.0-1vulnerable
Ubuntuglib2.0pro2.64.1-1vulnerable
Ubuntuglib2.0pro2.64.2-1~fakesync1vulnerable
Ubuntuglib2.0pro2.64.3-1~ubuntu20.04.1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.2vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.3vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.4vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.6vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.7vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.8vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9+esm1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9+esm2vulnerable
Ubuntuglib2.022.042.68.4-1ubuntu1vulnerable
Ubuntuglib2.022.042.70.1-1vulnerable
Ubuntuglib2.022.042.70.2-1vulnerable
Ubuntuglib2.022.042.71.0-2vulnerable
Ubuntuglib2.022.042.71.1-1vulnerable
Ubuntuglib2.022.042.71.2-1vulnerable
Ubuntuglib2.022.042.71.3-1vulnerable
Ubuntuglib2.022.042.72.0-1vulnerable
Ubuntuglib2.022.042.72.1-1vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu1vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.2vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.3vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.4vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.5vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.6vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.7vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.8vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.9fixed
Ubuntuglib2.024.042.78.0-2vulnerable
Ubuntuglib2.024.042.78.1-4vulnerable
Ubuntuglib2.024.042.78.3-1vulnerable
Ubuntuglib2.024.042.78.3-2vulnerable
Ubuntuglib2.024.042.79.1-1vulnerable
Ubuntuglib2.024.042.79.2-1~ubuntu1vulnerable
Ubuntuglib2.024.042.79.3-3ubuntu5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.2vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.4vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.6vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.7vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.8fixed
Ubuntuglib2.025.102.84.1-1vulnerable
Ubuntuglib2.025.102.84.1-2vulnerable
Ubuntuglib2.025.102.84.2-1vulnerable
Ubuntuglib2.025.102.84.3-1vulnerable
Ubuntuglib2.025.102.85.1-2vulnerable
Ubuntuglib2.025.102.85.2-2vulnerable
Ubuntuglib2.025.102.85.3-1vulnerable
Ubuntuglib2.025.102.86.0-2vulnerable
Ubuntuglib2.025.102.86.0-2ubuntu0.1vulnerable
Ubuntuglib2.025.102.86.0-2ubuntu0.2vulnerable
Ubuntuglib2.025.102.86.0-2ubuntu0.3fixed
Ubuntuglib2.026.042.86.0-2vulnerable
Ubuntuglib2.026.042.86.1-1vulnerable
Ubuntuglib2.026.042.86.1-2vulnerable
Ubuntuglib2.026.042.86.2-1vulnerable
Ubuntuglib2.026.042.86.3-1vulnerable
Ubuntuglib2.026.042.86.3-4vulnerable
Ubuntuglib2.026.042.87.2-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglib2.0sourcesid2.86.3-5not yet assignedNot reported[1126549]
Debianglib2.0sourceforky2.86.3-5not yet assignedNot reported[1126549]
Debianglib2.0sourcetrixie2.84.4-3~deb13u3not yet assignedNot reported[1126549]
Debianglib2.0sourcebookworm2.74.6-2+deb12u9not yet assignedNot reported[1126549]
Ubuntuglib2.0debnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0debnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0-devdebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0debnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0-devdebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-0debnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-devdebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-0t64debnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-bindebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-datadebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-devdebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-dev-bindebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-docdebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntulibglib2.0-testsdebnoble2.80.0-6ubuntu3.8Not reportedNot reportedNot reported
Ubuntuglib2.0deb22.042.72.4-0ubuntu2.9Not reportedUBUNTU-CVE-2026-1489Not reported
Ubuntuglib2.0deb24.042.80.0-6ubuntu3.8Not reportedUBUNTU-CVE-2026-1489Not reported
Ubuntuglib2.0deb25.102.86.0-2ubuntu0.3Not reportedUBUNTU-CVE-2026-1489Not reported
Ubuntuglib2.0deb26.042.87.2-2Not reportedUBUNTU-CVE-2026-1489Not reported

[Debian bug #1126549]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libglib2.0-0]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-bin]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-data]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-dev]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-doc]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u9

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

[Debian 13 (Trixie)]

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · all · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · all · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

  • Source package: [glib2.0]

    Details (2)
    • 2.84.4-3~deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

    • 2.84.4-3~deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.84.4-3~deb13u3

      usn · glib2.0 · debian · 13

Next results

Observed:

References