A flaw in GLib’s GIO library causes an unsigned integer overflow in the function that parses D‑Bus introspection XML. When a <node> element is nested inside elements such as <method> or <signal>, the parser overflows a 32‑bit counter and reads beyond allocated memory. This out‑of‑bounds read can crash the application, resulting in a denial of service. The weakness is identified as a type conversion error leading to unsigned integer overflow (CWE‑191).

The vulnerability affects systems that ship GLib with the GIO library, notably Red Hat Enterprise Linux distributions from version 6 through 10 and Red Hat Hardened Images. Any software on these platforms that processes D‑Bus introspection XML is potentially exposed.

The CVSS score of 7.5 indicates a high severity, and the EPSS score is not available. The CWE indicates that the flaw resides in handling of data. Based on the description, it is inferred that an attacker who can supply malformed D‑Bus introspection XML—either locally or remotely—to an application using g_dbus_node_info_new_for_xml() could trigger the overflow and crash it. No additional privileges or external infrastructure are required beyond the ability to deliver the crafted XML.