The vulnerability is a buffer underflow in glib's content type parsing logic caused by storing a header line length in a signed integer, which allows integer wraparound for very large inputs. The resulting pointer underflow leads to an out‑of‑bounds memory read that can crash the application or cause instability. The flaw is classified as an integer underflow (CWE‑124, CWE‑125) and a buffer overflow (CWE‑787). The impact is local denial of service or application instability when a local user processes a specially crafted treemagic file.

This flaw affects Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10, as all these distributions ship a vulnerable version of the glib library. No specific glib version range is provided in the advisory, so any RHEL system that has not applied the latest glib update may be exposed.

The CVSS score is 2.8, indicating moderate severity. EPSS is reported as less than 1%, meaning exploitation attempts are expected to be rare. The vulnerability is not listed in CISA’s KEV catalog. Because exploitation requires a local user to install or run a treemagic file, the likelihood of abuse is limited to environments where uncontrolled local access is possible. In most production setups, the risk is low, but any host that allows local untrusted users to create arbitrary files should be considered vulnerable.