An off-by-one error in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c causes a one-byte out-of-bounds read due to using '>' instead of '>=' in a bounds check. This results in a minor information disclosure of one byte and may cause a denial of service if the read crosses a page boundary. The vulnerability affects applications calling g_variant_is_normal_form(), g_variant_get_normal_form(), or g_variant_byteswap() on untrusted GVariant data from sources such as D-Bus, network, or files. Red Hat's advisory rates this as moderate severity with a CVSS 3.1 base score of 6.5 and has released patches in mingw-glib2 packages for Red Hat Enterprise Linux 8.

The vulnerability allows an attacker to cause a one-byte information disclosure and potentially trigger a denial of service via application crash if the out-of-bounds read crosses a page boundary. The information disclosure could leak memory contents that might aid in bypassing protection mechanisms like ASLR. The denial of service impact is considered low likelihood in production environments but can be reliably reproduced in AddressSanitizer builds.

Red Hat has released an official security update fixing this vulnerability in the mingw-glib2 package for Red Hat Enterprise Linux 8. Applying this update is the recommended remediation. No alternative mitigations meeting Red Hat's criteria are currently available. Users should apply the provided patches as detailed in the Red Hat advisory at https://access.redhat.com/errata/RHSA-2026:49512.