CVE-2026-16118

Fixed in a distro release EPSS <1%CVSS 7.1

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

Published 2026-07-17 · CVE record · OSV

Products: xdgmime, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18, Cert Manager support for Red Hat OpenShift release 1.20, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.5, Red Hat Cost Management On-Premise 1, Red Hat OpenShift AI 3.0, Red Hat OpenShift AI 3.2, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 3.5, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 7

Distro releases