Common Weakness Enumeration

CWE-124

Allowed

Buffer Underwrite ('Buffer Underflow')

Abstraction: Base · Status: Incomplete

The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

71 vulnerabilities reference this CWE, most recent first.

GHSA-XC99-2V4M-JV2W

Vulnerability from github – Published: 2026-01-27 15:30 – Updated: 2026-03-18 18:31
VLAI
Details

A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-1485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-124",
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-27T14:15:56Z",
    "severity": "LOW"
  },
  "details": "A flaw was found in Glib\u0027s content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.",
  "id": "GHSA-xc99-2v4m-jv2w",
  "modified": "2026-03-18T18:31:10Z",
  "published": "2026-01-27T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-1485"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation
Requirements

Choose a language that is not susceptible to these issues.

Mitigation
Implementation

All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.

No CAPEC attack patterns related to this CWE.