The flaw exists in the glib library’s g_buffered_input_stream_peek() function, which does not validate the offset and count parameters supplied to it. A crafted combination of these values can trigger an integer overflow during the length calculation, resulting in an incorrect size being passed to memcpy(). The resulting buffer overflow causes the application to crash, thereby denying service to legitimate users.

Red Hat Enterprise Linux releases 6, 7, 8, 9, 10 and Red Hat Hardened Images that ship glib are affected. The vulnerability applies to any instance of the glib library used by applications on these platforms, regardless of the exact glib version, until the Red Hat‑issued patch is installed.

The CVSS score of 3.7 indicates moderate severity, while the EPSS score of <1% indicates a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply malicious offset and count values to g_buffered_input_stream_peek(). The description does not detail the exact interface, so based on the description it is inferred that the attack could occur if the application accepts untrusted input—such as from a network connection, file, or user data—under that function. In the absence of a public workaround, mitigation hinges on applying the vendor patch or modifying the application code.