CVE-2026-0988: glib: integer overflow in buffered stream peek causes DoS

CVE-2026-0988 is an integer overflow in glib's g_buffered_input_stream_peek() that leads to a bad memcpy size and a buffer overflow, which in practice crashes the application (denial of service). It is rated low (CVSS 3.7) with high attack complexity, no known public exploit, no Nuclei template, no KEV listing, and no EPSS data, so active exploitation is unlikely. The reason to track it is breadth: glib is a foundational library with 695 tracked downstream dependents, and it ships inside many Red Hat OpenShift AI (rhoai) container images such as model serving, MLflow, Ray and notebook controllers. Treat this as routine patching: apply Red Hat's RHSA-2026:7461 and rebuild or redeploy affected rhoai images through normal maintenance windows, and prioritize only components that parse untrusted buffered stream input over the network.

No confirmed active exploitation of CVE-2026-0988 has been reported, but organizations should still patch proactively.

1) Apply Red Hat advisory RHSA-2026:7461 and the upstream glib fix tracked in GNOME/glib issue 3851. 2) Rebuild and redeploy the rhoai container images and any custom images based on affected RHEL bases, and refresh base images in CI. 3) Use SBOM or image scanning to find glib2 versions in ML workloads, including bootc and rpm-ostree hosts. 4) Rely on pod restart policies and health probes to limit the impact of crashes. 5) Monitor for repeated crashes or core dumps from glib-linked processes. 6) Where feasible, validate offset and count inputs before they reach buffered stream peek calls.

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps platforms, Kubernetes-based AI platforms, notebook and workbench environments.

CVE-2026-0988 has a CVSS v3.1 base score of 3.7 (LOW).