The flaw lies in GLib’s D‑Bus client‑side handling of the DBUS_COOKIE_SHA1 SASL authentication mechanism: the cookie_context value supplied by a server is not validated. A malicious or impersonating D‑Bus server can therefore inject a cookie_context containing path‑traversal sequences, and the client will read the referenced file, output a hash of its contents, and transmit that hash back to the server. This enables an attacker to read arbitrary files that the client process can access, potentially exposing credentials or configuration data.

GNOME’s GLib library and Red Hat Enterprise Linux releases 6, 7, 8, 9, 10, along with Red Hat Hardened Images are affected. All systems running an impacted GLib version are susceptible; the advisory does not specify exact patch levels, but any installation that uses the flawed GLib code is at risk.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is <1% (approximately 0.3%) and the issue is not listed in the CISA KEV catalog. Exploit requires a malicious or spoofed D‑Bus service that the client will trust. Once such a service is established, the attacker can read any file accessible to the client process, enabling exfiltration of sensitive data. Isolation of D‑Bus traffic, strict authentication rules, and disabling the vulnerable mechanism substantially reduce this risk.