An off‑by‑one condition was discovered in the GLib routine g_key_file_get_locale_string_list. When a key file contains an empty value, the routine performs an out‑of‑bounds memory read or write of a single byte. If the faulty access crosses a memory page boundary, it can trigger a crash that results in a denial of service. The weakness is an implementation bug classified as CWE‑193, which typically leads to reliability and availability problems rather than privilege escalation or data disclosure.

The flaw affects Red Hat Enterprise Linux distributions 6, 7, 8, 9 and 10, as well as Red Hat Hardened Images, through the bundled GLib library. The vulnerability is triggered by loading malformed key files such as .desktop or .ini that are processed by applications using the g_key_file_get_locale_string_list function.

The CVSS score of 7.3 reflects a medium to high severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. However, because the flaw operates on key files that are often loaded from user supplied or network sources, an attacker who can supply a crafted file to a vulnerable application may cause that application to crash. The likely attack vector is local file or possibly remote if an application reads untrusted key files from the network. The exploit would lead to denial of service of the affected application and, in worst cases, could degrade overall system availability if the crash cascades.