A buffer‑underflow flaw in GLib’s GVariant parser can corrupt heap memory when processing maliciously crafted strings. The consequence is a denial of service or, in the worst case, arbitrary code execution as the corrupted memory can be leveraged to overwrite critical data structures. The weakness is classified as a heap based buffer overflow (CWE‑122) and involves integer conversion errors (CWE‑190).

The vulnerability affects the GNOME GLib library and a range of Red Hat Enterprise Linux releases from 6 up through 10, including Red Hat Hardened Images. Any system that relies on the vulnerable version of GLib may be impacted, especially services that parse untrusted data with GVariant.

The CVSS score of 5.6 indicates a moderate severity, and the EPSS score of less than 1% implies a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker supplying malicious input to an application that uses the vulnerable GVariant parser; this requires the attacker to have a path to inject or influence the data processed by the parser.