An off-by-one error in the PKCS#12 bag element bounds check within the gnutls library in Red Hat Enterprise Linux 10 allows a remote attacker to write beyond the internal array boundary when appending to a bag containing 32 elements. This memory corruption vulnerability can cause denial of service or potentially other impacts. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability. The vendor advisory does not specify a remediation level or patch availability at this time.

The vulnerability enables a remote attacker to cause memory corruption by writing past the bounds of an internal array in the PKCS#12 bag structure. This can result in denial of service conditions or potentially other unspecified impacts. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-42015 for current remediation guidance. Until a patch or official fix is available, monitor vendor communications for updates. No vendor advisory content indicates that no action is required or that the issue is already mitigated.