This vulnerability arises from an off-by-one error in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c in GLib. The bounds check uses a greater-than operator (>) instead of greater-than-or-equal (>=), resulting in a single byte being read out-of-bounds. The impact includes minor information disclosure of one byte and a denial of service condition if the out-of-bounds read crosses a page boundary. The vulnerability affects Red Hat Enterprise Linux 10. There is no explicit remediation level or patch information provided in the vendor advisory at this time.

The vulnerability can disclose one byte of information beyond intended memory bounds, which is a minor information leak. Additionally, if the out-of-bounds read crosses a page boundary, it can cause a denial of service by crashing the affected process. No integrity impact is reported. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58010 for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor advisory for updates and apply patches once available.