An out-of-bounds read vulnerability exists in GLib's g_date_time_get_ymd function due to improper handling of invalid GDateTime objects created by g_date_time_add_full. The flaw causes a 2-byte out-of-bounds read that can corrupt date values, potentially triggering logic errors and denial of service in applications relying on these dates. The vulnerability requires no privileges or user interaction and can be triggered remotely via network vectors if user-supplied dates are processed. Red Hat has issued a security advisory and update to fix this issue, recommending input validation to prevent invalid date inputs that lead to negative or zero days fields.

The vulnerability can cause corrupted date outputs leading to logic errors and denial of service conditions in affected applications. The out-of-bounds read itself is limited to 2 bytes and does not impact confidentiality but may cause application crashes or unexpected behavior. There are no known exploits in the wild. The CVSS v3.1 base score is 6.5 (medium severity), reflecting the potential for denial of service without confidentiality or integrity impact.

Red Hat has released security updates that fix this vulnerability; applying these updates is the recommended remediation. Additionally, applications processing user-supplied dates should implement input validation to ensure dates are within supported ranges, specifically rejecting inputs that produce negative or zero days fields before calling g_date_time_add_full. This mitigates the risk of triggering the out-of-bounds read. No other mitigations are specified by the vendor.