Skip to content
Fencer Vulns
high 7.1

CVE-2026-16118 json

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

published 2026-07-17 3 mo ago modified 2026-11-06 3 d ago also EUVD-2026-45266

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:2.80.4-12.el10_2.22
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:2.80.4-4.el10_0.18
  • Red Hat Red Hat Enterprise Linux 8 0:2.56.4-178.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:2.68.4-19.el9_8.10
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.68.4-7.el9_2.8
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.68.4-14.el9_4.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.68.4-16.el9_6.8
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371069, 1791371080, 1791378395, 1791788287, 1791970484
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790223279, 1790223719, 1790272426, 1790589855, 1790589912, 1790589914, 1790589998, 1790598593
  • Red Hat Red Hat AI Inference Server 3.2 1790621713, 1790621714, 1790621718
  • Red Hat Red Hat AI Inference Server 3.5 1791425869, 1791427182, 1791473614, 1791473631, 1791803821, 1791818357
  • Red Hat Red Hat Cost Management On-Premise 1 1791460851
  • Red Hat Red Hat Enterprise Linux AI 3.5 1793135861, 1793135863, 1793194815, 1793194817, 1793194834, 1793206758
  • Red Hat Red Hat OpenShift AI 3.0 1790276884, 1790276886, 1790276889, 1790276974, 1790277045
  • Red Hat Red Hat OpenShift AI 3.2 1790703494, 1790703497, 1790703506, 1790703568, 1790703586, 1790703590
  • Red Hat Red Hat OpenShift AI 3.3 1790703516, 1790703524, 1790703579, 1790703601, 1790703608, 1790703615, 1791231820, 1791232257
  • Red Hat Red Hat OpenShift AI 3.4 1790703539, 1790703541, 1790703542, 1790703545, 1790703553, 1790703597, 1790703630, 1790703631, 1790703641
  • Red Hat Red Hat OpenShift AI 3.5 1790703552, 1790703554, 1790703557, 1790703630, 1790703645, 1790703656, 1790703706, 1790703707
  • Red Hat Red Hat Update Infrastructure 5 1789478095, 1789479891, 1789479900, 1789479916, 1789482961
  • glib2.0 Debian 13 2.84.4-3~deb13u5
  • glib2.0 Debian 14 2.88.3-3

debian advisories DEBIAN-CVE-2026-16118

  • glib2.0 Ubuntu 22.04 LTS 2.72.4-0ubuntu2.10
  • glib2.0 Ubuntu 24.04 LTS 2.80.0-6ubuntu3.9
  • glib2.0 Ubuntu 26.04 LTS 2.88.0-1ubuntu0.1
  • glib2.0 Ubuntu Pro 14.04 LTS 2.40.2-0ubuntu1.1+esm8
  • glib2.0 Ubuntu Pro 16.04 LTS 2.48.2-0ubuntu4.8+esm6
  • glib2.0 Ubuntu Pro 18.04 LTS 2.56.4-0ubuntu0.18.04.9+esm6
  • glib2.0 Ubuntu Pro 20.04 LTS 2.64.6-1~ubuntu20.04.9+esm2

ubuntu advisories UBUNTU-CVE-2026-16118

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • glib2 RHEL 8 2.56.4-178.el8_10
  • glib2-fam RHEL 8 2.56.4-178.el8_10
  • glib2-tests RHEL 8 2.56.4-178.el8_10
  • glib2 RHEL 9 2.68.4-19.el9_8.10
  • glib2-tests RHEL 9 2.68.4-19.el9_8.10
  • glib2 RHEL 10.2 2.80.4-12.el10_2.22
  • glib2-tests RHEL 10.2 2.80.4-12.el10_2.22
  • glib2 RHEL 9.6 EUS 2.68.4-16.el9_6.8

red hat advisories RHSA-2026:71403RHSA-2026:71404RHSA-2026:71405RHSA-2026:70636RHSA-2026:66451RHSA-2026:64800

  • glib2 AlmaLinux 8 2.56.4-178.el8_10
  • glib2-fam AlmaLinux 8 2.56.4-178.el8_10
  • glib2-tests AlmaLinux 8 2.56.4-178.el8_10
  • glib2 AlmaLinux 10 2.80.4-12.el10_2.22
  • glib2-tests AlmaLinux 10 2.80.4-12.el10_2.22
  • glib2 AlmaLinux 9 2.68.4-19.el9_8.10
  • glib2-tests AlmaLinux 9 2.68.4-19.el9_8.10

almalinux advisories ALSA-2026:66451ALSA-2026:64799ALSA-2026:64800

  • glib2 Rocky Linux 8 2.56.4-178.el8_10
  • glib2 Rocky Linux 10 2.80.4-12.el10_2.22
  • glib2 Rocky Linux 9 2.68.4-19.el9_8.10

rocky linux advisories RLSA-2026:66451RLSA-2026:64799RLSA-2026:64800

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-16118 updated cvss 7.1

xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

  • Red Hat Enterprise Linux 7 glib2, glib2-fam, webkitgtk4, glib2-tests, webkitgtk4-jsc, webkitgtk4-plugin-process-gtk2
    affected: workaround, no fix available, no fix planned “Do not install a MIME magic file or content from untrusted sources.”
  • Red Hat Enterprise Linux 8 webkit2gtk3, webkit2gtk3-jsc, webkit2gtk3-plugin-process-gtk2 Red Hat Enterprise Linux 9 webkit2gtk3, webkit2gtk3-jsc
    affected: workaround, no fix planned “Do not install a MIME magic file or content from untrusted sources.”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-istio-csr-rhel9 1791378395, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:82336
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +2 more
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:72475
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1790621718, rhaiis/vllm-rocm-rhel9 1790621713, rhaiis/model-opt-cuda-rhel9 1790621714
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:73859
  • Red Hat AI Inference Server 3.5 rhaii/vllm-cpu-rhel9 1791473614, rhaii/vllm-cuda-rhel9 1791473631, rhaii/vllm-rocm-rhel9 1791425869, rhaii/vllm-gaudi-rhel9 1791427182, rhaii/vllm-spyre-rhel9 1791818357, rhaii/model-opt-cuda-rhel9 1791803821
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:82066
  • Red Hat CodeReady Linux Builder EUS (v.9.6) glib2-static 2.68.4-16.el9_6.8, glib2-debuginfo 2.68.4-16.el9_6.8, glib2-debugsource 2.68.4-16.el9_6.8, glib2-devel-debuginfo 2.68.4-16.el9_6.8, glib2-tests-debuginfo 2.68.4-16.el9_6.8
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71403
show 26 more
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1791460851
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:79357
  • Red Hat Enterprise Linux AI 3.5 rhelai3/bootc-cuda-rhel9 1793135861, rhelai3/bootc-rocm-rhel9 1793135863, rhelai3/bootc-aws-cuda-rhel9 1793194817, rhelai3/bootc-gcp-cuda-rhel9 1793194815, rhelai3/disk-image-cuda-rhel9 1793206758, rhelai3/bootc-azure-cuda-rhel9 1793194815, +1 more
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:92452
  • Red Hat Enterprise Linux AppStream (v. 9) glib2-tests 2.68.4-19.el9_8.10
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:64800
  • Red Hat Enterprise Linux AppStream (v. 10) glib2-tests 2.80.4-12.el10_2.22
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:64799
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) glib2-tests 2.68.4-7.el9_2.8
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71405
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) glib2-tests 2.68.4-14.el9_4.9
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:70636
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) glib2-tests 2.80.4-4.el10_0.18
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71404
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) glib2-tests 2.68.4-16.el9_6.8
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71403
  • Red Hat Enterprise Linux BaseOS (v. 8) glib2 2.56.4-178.el8_10, glib2-fam 2.56.4-178.el8_10, glib2-tests 2.56.4-178.el8_10
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:66451
  • Red Hat Enterprise Linux BaseOS (v. 9) glib2 2.68.4-19.el9_8.10
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:64800
  • Red Hat Enterprise Linux BaseOS (v. 10) glib2 2.80.4-12.el10_2.22
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:64799
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) glib2 2.68.4-7.el9_2.8
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71405
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) glib2 2.68.4-14.el9_4.9
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:70636
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) glib2 2.80.4-4.el10_0.18
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71404
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) glib2 2.68.4-16.el9_6.8
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71403
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) glib2-static 2.68.4-19.el9_8.10, glib2-debuginfo 2.68.4-19.el9_8.10, glib2-debugsource 2.68.4-19.el9_8.10, glib2-devel-debuginfo 2.68.4-19.el9_8.10, glib2-tests-debuginfo 2.68.4-19.el9_8.10
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:64800
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glib2-doc 2.80.4-12.el10_2.22, glib2-static 2.80.4-12.el10_2.22, glib2-debuginfo 2.80.4-12.el10_2.22, glib2-debugsource 2.80.4-12.el10_2.22, glib2-devel-debuginfo 2.80.4-12.el10_2.22, glib2-tests-debuginfo 2.80.4-12.el10_2.22
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:64799
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) glib2-doc 2.80.4-4.el10_0.18, glib2-static 2.80.4-4.el10_0.18, glib2-debuginfo 2.80.4-4.el10_0.18, glib2-debugsource 2.80.4-4.el10_0.18, glib2-devel-debuginfo 2.80.4-4.el10_0.18, glib2-tests-debuginfo 2.80.4-4.el10_0.18
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:71404
  • Red Hat Enterprise Linux CRB (v. 8) glib2-doc 2.56.4-178.el8_10, glib2-static 2.56.4-178.el8_10, glib2-debuginfo 2.56.4-178.el8_10, glib2-debugsource 2.56.4-178.el8_10, glib2-fam-debuginfo 2.56.4-178.el8_10, glib2-devel-debuginfo 2.56.4-178.el8_10, +1 more
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:66451
  • Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1790277045, rhai/base-image-tpu-rhel9 1790276884, rhai/base-image-cuda-rhel9 1790276974, rhai/base-image-rocm-rhel9 1790276886, rhai/base-image-spyre-rhel9 1790276889
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:73960
  • Red Hat OpenShift AI 3.2 rhai/base-image-cpu-rhel9 1790703590, rhai/base-image-tpu-rhel9 1790703497, rhai/base-image-cuda-rhel9 1790703586, rhai/base-image-rocm-rhel9 1790703494, rhai/base-image-rocm-rhel9 1790703506, rhai/base-image-spyre-rhel9 1790703568
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:74460
  • Red Hat OpenShift AI 3.3 rhai/base-image-cpu-rhel9 1790703615, rhai/base-image-tpu-rhel9 1790703516, rhai/base-image-spyre-rhel9 1790703579, rhai/base-image-neuron-rhel9 1790703516, rhai/base-image-rocm-6.4-rhel9 1790703524, rhai/base-image-rocm-7.0-rhel9 1790703516, +4 more
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:74359
  • Red Hat OpenShift AI 3.4 rhai/base-image-cpu-rhel9 1790703631, rhai/base-image-tpu-rhel9 1790703539, rhai/base-image-gaudi-rhel9 1790703553, rhai/base-image-spyre-rhel9 1790703597, rhai/base-image-neuron-rhel9 1790703542, rhai/base-image-rocm-6.4-rhel9 1790703545, +3 more
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:74679
  • Red Hat OpenShift AI 3.5 rhai/base-image-cpu-rhel9 1790703656, rhai/base-image-tpu-rhel9 1790703554, rhai/base-image-gaudi-rhel9 1790703552, rhai/base-image-rubin-rhel9 1790703707, rhai/base-image-spyre-rhel9 1790703630, rhai/base-image-neuron-rhel9 1790703557, +3 more
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:75652
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1789479900, rhui5/rhua-rhel9 1789478095, rhui5/haproxy-rhel9 1789479891, rhui5/installer-rhel9 1789482961, rhui5/cds-kubernetes-rhel9 1789479916
    fixed: vendor fix “Do not install a MIME magic file or content from untrusted sources.” RHSA-2026:67956
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/jetstack-cert-manager-acmesolver-rhel9 1790223630 Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-k8s-operator-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.freedesktop.org https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected products

  • xdg xdgmime
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.5
  • Red Hat Red Hat Cost Management On-Premise 1
  • Red Hat Red Hat Enterprise Linux AI 3.5
  • Red Hat Red Hat OpenShift AI 3.0
  • Red Hat Red Hat OpenShift AI 3.2
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI 3.5
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.