CVE-2026-58016: GLib: malformed D-Bus XML integer overflow causes DoS

HIGH

Published June 30, 2026

CISO Take

CVE-2026-58016 is an unsigned integer overflow in GLib's g_dbus_node_info_new_for_xml() that triggers an out-of-bounds read when parsing malformed D-Bus introspection XML, crashing the process. It is rated high (CVSS 7.5, network, no privileges, availability-only impact), but this is a general-purpose system library flaw rather than an AI-specific one, and it only matters where an application passes untrusted XML to that parser. Exploitation signals are weak: it is not in CISA KEV, no public exploit or Nuclei template exists, and no EPSS score is available. Exposure is broad but shallow, because Red Hat ships GLib in many container images, including the rhai base images for CUDA, ROCm, CPU, TPU, Spyre and Neuron and the rhoai llama-stack operator. Apply the Red Hat errata (for example RHSA-2026:42063) and rebuild or redeploy AI base images and operator containers, prioritizing any service that handles D-Bus introspection data from untrusted sources.

Sources:NVDRed Hat Security AdvisoriesATLAS

What is the risk?

Moderate overall. The CVSS vector is network/low complexity/no privileges, but impact is limited to availability, and real-world reachability depends on whether an application feeds attacker-controlled introspection XML into g_dbus_node_info_new_for_xml(). Most AI/ML workloads never do, so practical exposure is low. There is no known exploitation, no public PoC, and no SSVC decision. The package risk score is 0/100 and the AI classification (llm_framework) reflects bundling in AI base images rather than an AI-specific flaw.

How does the attack unfold?

Initial Access

Attacker delivers crafted D-Bus introspection XML to an application that parses untrusted input via GLib.

AML.T0049

Exploitation

A node element nested inside a method, signal, property or arg element triggers an unsigned integer overflow (CWE-191) in g_dbus_node_info_new_for_xml().

Impact

An out-of-bounds read crashes the process, causing denial of service for the containerized AI/ML component.

AML.T0029

Initial Access

Attacker delivers crafted D-Bus introspection XML to an application that parses untrusted input via GLib.

AML.T0049

Exploitation

A node element nested inside a method, signal, property or arg element triggers an unsigned integer overflow (CWE-191) in g_dbus_node_info_new_for_xml().

Impact

An out-of-bounds read crashes the process, causing denial of service for the containerized AI/ML component.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Llama Stack	pip	—	No patch
8.4K14 dependentsPushed 5d ago33% patched~0d to patchFull package profile →
Llama Stack	pip	—	No patch
8.4K14 dependentsPushed 5d ago33% patched~0d to patchFull package profile →
GLib	—	—	No patch
cert-manager/cert-manager-istio-csr-rhel9	—	—	No patch
cert-manager/cert-manager-operator-bundle	—	—	No patch
cert-manager/cert-manager-operator-rhel9	—	—	No patch
cert-manager/cert-manager-trust-manager-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-acmesolver-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-rhel9	—	—	No patch
discovery/discovery-server-rhel9	—	—	No patch
discovery/discovery-ui-rhel9	—	—	No patch
glib2	—	—	No patch
insights-proxy/insights-proxy-container-rhel9	—	—	No patch
mingw-glib2	—	—	No patch
rhai/base-image-cpu-rhel9	—	—	No patch
rhai/base-image-cuda-rhel9	—	—	No patch
rhai/base-image-neuron-rhel9	—	—	No patch
rhai/base-image-rocm-rhel9	—	—	No patch
rhai/base-image-spyre-rhel9	—	—	No patch
rhai/base-image-tpu-rhel9	—	—	No patch
rhui5/cds-kubernetes-rhel9	—	—	No patch
rhui5/cds-kubernetes-tp-rhel9	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/installer-tp-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch
rhui5/rhua-tp-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Install the Red Hat updates referenced in RHSA-2026:42063, 42089, 42090, 44481, 46836, 49512 and 51175-51181 as applicable to your images. 2) Rebuild and redeploy container images derived from the affected rhai/rhoai, cert-manager, discovery, insights-proxy and rhui5 bases. 3) Run an SBOM or image scan for glib2 versions to find unpatched workloads. 4) Do not pass untrusted XML to g_dbus_node_info_new_for_xml(). 5) Monitor for unexpected crashes or restarts of services using GLib D-Bus parsing, and enable container restart and crash alerting.

How is it classified?

DoSFrameworkInferenceAML.T0010.001- AI Software AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage third-party components

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-58016?

Is CVE-2026-58016 actively exploited?

No confirmed active exploitation of CVE-2026-58016 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-58016?

1) Install the Red Hat updates referenced in RHSA-2026:42063, 42089, 42090, 44481, 46836, 49512 and 51175-51181 as applicable to your images. 2) Rebuild and redeploy container images derived from the affected rhai/rhoai, cert-manager, discovery, insights-proxy and rhui5 bases. 3) Run an SBOM or image scan for glib2 versions to find unpatched workloads. 4) Do not pass untrusted XML to g_dbus_node_info_new_for_xml(). 5) Monitor for unexpected crashes or restarts of services using GLib D-Bus parsing, and enable container restart and crash alerting.

What systems are affected by CVE-2026-58016?

This vulnerability affects the following AI/ML architecture patterns: Containerized model serving, GPU/accelerator base images, Kubernetes operators, Llama Stack deployments.

What is the CVSS score for CVE-2026-58016?

CVE-2026-58016 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

Containerized model servingGPU/accelerator base imagesKubernetes operatorsLlama Stack deployments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

Exploitation Scenario

An attacker able to supply crafted D-Bus introspection XML, with a node element nested inside a method, signal, property or arg element, to a service that parses it with GLib's GDBus introspection API could trigger the integer overflow and out-of-bounds read. The result is a crash of that service. In an AI context, this could take down a containerized inference or operator component built on an affected base image, causing a denial of service. It requires an application path that accepts untrusted XML, which is uncommon.

Weaknesses (CWE)

CWE-191Integer Underflow (Wrap or Wraparound)

CWE-191 — Integer Underflow (Wrap or Wraparound): The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Source: MITRE CWE corpus.