CVE-2026-58010 is an off-by-one error in GLib's gvs_tuple_is_normal function within the gvariant-serialiser.c source file. The vulnerability arises because the bounds check uses a greater-than (>) operator instead of greater-than-or-equal-to (>=), resulting in an out-of-bounds read of a single byte during alignment padding checks. This can cause minor information disclosure of one byte and potentially a denial of service if the out-of-bounds read crosses a memory page boundary. Red Hat advisories confirm the issue and provide patches for affected GLib packages in Red Hat Enterprise Linux 8 and 9.

The vulnerability allows an out-of-bounds read of one byte, which can lead to minor information disclosure and denial of service conditions if the read crosses a page boundary. There are no known exploits in the wild. The CVSS 3.1 base score is 6.5, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality and availability.

Red Hat has issued security updates for GLib packages in Red Hat Enterprise Linux 8 and 9 that fix this vulnerability. Users should apply the relevant security patches as provided in Red Hat advisories RHSA-2026:49512 and RHSA-2026:55440. Details and update instructions are available at https://access.redhat.com/articles/11258. No other mitigation is required as the issue is addressed by these official fixes.