This vulnerability in libgnutls arises from improper validation of the premaster secret length during an RSA key exchange backed by a PKCS#11 token. By sending an abnormally short premaster secret, a remote attacker can cause a heap overread, resulting in memory corruption. The flaw could allow disclosure of sensitive information from the affected system. It affects Red Hat Enterprise Linux 10. The CVSS 3.1 score is 8.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss and high availability impact. No official patch or remediation level has been published yet according to the vendor advisory.

The vulnerability can lead to information disclosure due to memory corruption caused by a heap overread during RSA key exchange operations. This compromises confidentiality and causes a high impact on availability. No integrity impact is reported. There are no known exploits in the wild, so active exploitation has not been observed.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5260 for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No vendor-provided mitigation or workaround is currently documented.