An off-by-one error in the gvs_tuple_is_normal function in glib/gvariant-serialiser.c causes an out-of-bounds read of one byte due to improper bounds checking (using > instead of >=). This can disclose one byte of memory and cause denial of service if the read crosses a page boundary. The issue affects applications calling g_variant_is_normal_form(), g_variant_get_normal_form(), or g_variant_byteswap() on untrusted GVariant data from sources like D-Bus, network, or files. Red Hat's advisory confirms the vulnerability and rates it as moderate severity with a CVSS 3.1 base score of 6.5. The advisory notes that no effective mitigation currently exists that meets their criteria, but security updates have been released for Red Hat Enterprise Linux 8 and related products.

The vulnerability allows an attacker to cause a minor information disclosure of one byte and potentially trigger a denial of service via application crash if the out-of-bounds read crosses a page boundary. The information disclosure could aid in bypassing protection mechanisms such as ASLR. The denial of service impact is considered low likelihood in production environments but can be reliably reproduced in AddressSanitizer builds. No known exploits are reported in the wild.

Red Hat states that no mitigation is currently available or meets their criteria for ease of use, deployment, applicability, or stability. However, a security update fixing this vulnerability has been released for affected Red Hat products, including Red Hat Enterprise Linux 8. Users should apply the available security updates as described in the Red Hat advisory (RHSA-2026:49512). Monitoring vendor advisories for updates and applying patches promptly is recommended.