GLib

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. GLib sits in Tier 2, which caps at $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Memory-safety hardening can carry a 2× or 3× multiplier. Patches must be between one and twelve months old, submissions are rate-limited to three a month, and sanctions and territory exclusions apply. CVE history 13 Last 12 months 50 Lifetime Memory safety 45 % Parsing/validation 20 % Denial of service 20 % Access control 10 % Latest advisories Loading the feed Overview GLib is the core C library linked into effectively every process on a Linux desktop and into a very large share of Linux server and embedded userland: GStreamer, NetworkManager, systemd-adjacent tooling and the entire GTK application ecosystem all depend on it. GDBus, its D-Bus implementation, carries privileged inter-process communication between unprivileged sessions and system daemons, so a GLib defect is a standard privilege-escalation primitive rather than a desktop nuisance. The project pays nothing for a report: GNOME's process is a confidential GitLab issue, and the European bounty that used to cover GLib was removed in February 2026. sorona.xyz pays you directly on qualified, reproduced findings. In scope GNOME takes security reports on GLib as confidential issues on GNOME GitLab, per the project's SECURITY.md, and draws no boundary narrower than the GLib module itself GLib core in full: the data structures, string and Unicode handling, the main loop, the threading primitives, and the GVariant serialisation that every dependent process routes untrusted bytes through GIO as a whole, covering the file, stream, socket and network abstractions, the application and settings machinery, and the GVfs boundary where a remote or removable source becomes a local file operation GDBus end to end, the D-Bus implementation that carries privileged desktop IPC between an unprivileged session and a system daemon: message parsing, the connection and proxy layer, and name ownership The bundled parsers and format handlers, GKeyFile , GMarkup , the URI code and the option parser among them, which read configuration and markup that is not always trusted The GObject type system, signal machinery and property handling, where type confusion becomes a memory-safety problem for every caller The GModule and GIRepository layers, plus the subprocess and spawn paths that hand data to another process Out of scope Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail GTK itself, a separate module that was never inside the GNOME bounty scope either soupserver , explicitly excluded by the archived GNOME program Application-level bugs in GNOME desktop components rather than defects in GLib Anything that requires an already-compromised session bus, which sits inside the trust boundary Patches outside the one-to-twelve-month age window the program requires Most-valued findings Memory-safety defects in GVariant deserialisation reachable from a D-Bus message, the largest bug class here at 45% and the one the 2026 advisory spike is concentrated on GDBus flaws that let an unprivileged session message confuse or corrupt a system daemon on the other side of the bus, the standard Linux privilege-escalation primitive Out-of-bounds access in GKeyFile or GMarkup driven by a configuration or markup file the user did not author GIO and GVfs path handling that turns a remote or removable mount into a write outside the intended location GObject type-system or signal-machinery confusion that becomes exploitable in an arbitrary downstream consumer rather than only in GLib's own tests Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The cash on Google's rail is paid for a merged upstream patch rather than for a vulnerability report. A report on its own earns nothing there GLib develops on GNOME GitLab, so the merged artefact is a GitLab merge request rather than a GitHub pull request Keep the patch merged, without reverts, for one month before claiming, and submit it while it is between one and twelve months old Three Patch Rewards submissions per person per month is the hard cap Google cannot pay individuals or entities on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure GNOME takes security reports as confidential issues on GNOME GitLab, per the project's SECURITY.md, and pays nothing for them. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability