new file mode 100644
@@ -0,0 +1,106 @@
+From ba0478c206bc04542df774343c6c85f77df49f6e Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Sat, 11 Apr 2026 14:42:57 +0100
+Subject: [PATCH] gkeyfile: Fix a one-byte heap under-read with
+ g_key_file_get_locale_string_list()
+
+If this method was called on a key file key which has an empty value,
+`len == 0` and this leads to a one-byte under-read off the start of the
+key file buffer.
+
+Spotted by linhlhq as #YWH-PGM9867-200. The suggested fix is theirs, and
+the unit test is adapted from their report. I added the fuzzing test.
+
+Fixes: #3930
+
+CVE: CVE-2026-58014
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/94ecb5b44a1cae09f481dd5e693832f129948893]
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+(cherry picked from commit 94ecb5b44a1cae09f481dd5e693832f129948893)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ fuzzing/fuzz_key.c | 9 +++++++++
+ glib/gkeyfile.c | 2 +-
+ glib/tests/keyfile.c | 23 +++++++++++++++++++++++
+ 3 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/fuzzing/fuzz_key.c b/fuzzing/fuzz_key.c
+index 77cb684..7d00443 100644
+--- a/fuzzing/fuzz_key.c
++++ b/fuzzing/fuzz_key.c
+@@ -26,11 +26,20 @@ test_parse (const gchar *data,
+ GKeyFileFlags flags)
+ {
+ GKeyFile *key = NULL;
++ char *comment = NULL;
++ char **list = NULL;
+
+ key = g_key_file_new ();
+ g_key_file_load_from_data (key, (const gchar*) data, size, G_KEY_FILE_NONE,
+ NULL);
+
++ /* Also try some additional parsing and see if it crashes */
++ comment = g_key_file_get_comment (key, "group", "key", NULL);
++ g_free (comment);
++
++ list = g_key_file_get_locale_string_list (key, "group", "key", "de", NULL, NULL);
++ g_strfreev (list);
++
+ g_key_file_free (key);
+ }
+
+diff --git a/glib/gkeyfile.c b/glib/gkeyfile.c
+index d08a485..54d77a5 100644
+--- a/glib/gkeyfile.c
++++ b/glib/gkeyfile.c
+@@ -2421,7 +2421,7 @@ g_key_file_get_locale_string_list (GKeyFile *key_file,
+ }
+
+ len = strlen (value);
+- if (value[len - 1] == key_file->list_separator)
++ if (len > 0 && value[len - 1] == key_file->list_separator)
+ value[len - 1] = '\0';
+
+ list_separator[0] = key_file->list_separator;
+diff --git a/glib/tests/keyfile.c b/glib/tests/keyfile.c
+index bc125c1..289bd2b 100644
+--- a/glib/tests/keyfile.c
++++ b/glib/tests/keyfile.c
+@@ -850,6 +850,28 @@ test_locale_string_multiple_loads (void)
+ g_free (old_locale);
+ }
+
++static void
++test_locale_string_empty (void)
++{
++ GKeyFile *keyfile = NULL;
++ GError *local_error = NULL;
++ const char *data =
++ "[valid]\n"
++ "key1=\n";
++
++ g_test_summary ("Check that loading an empty translatable string works");
++ g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3930");
++
++ keyfile = g_key_file_new ();
++
++ g_key_file_load_from_data (keyfile, data, -1, G_KEY_FILE_NONE, &local_error);
++ g_assert_no_error (local_error);
++
++ check_locale_string_list_value (keyfile, "valid", "key1", NULL, NULL);
++
++ g_key_file_free (keyfile);
++}
++
+ static void
+ test_lists (void)
+ {
+@@ -1939,6 +1961,7 @@ main (int argc, char *argv[])
+ g_test_add_func ("/keyfile/number", test_number);
+ g_test_add_func ("/keyfile/locale-string", test_locale_string);
+ g_test_add_func ("/keyfile/locale-string/multiple-loads", test_locale_string_multiple_loads);
++ g_test_add_func ("/keyfile/locale-string/empty", test_locale_string_empty);
+ g_test_add_func ("/keyfile/lists", test_lists);
+ g_test_add_func ("/keyfile/lists-set-get", test_lists_set_get);
+ g_test_add_func ("/keyfile/group-remove", test_group_remove);
@@ -51,6 +51,7 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2026-58011.patch \
file://CVE-2026-58012.patch \
file://CVE-2026-58013.patch \
+ file://CVE-2026-58014.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \