An out-of-bounds read vulnerability exists in GLib's g_date_time_get_ymd function triggered by invalid GDateTime objects created via g_date_time_add_full. The flaw reads 2 bytes beyond the intended buffer, potentially corrupting date output and causing logic errors that can lead to denial of service. The issue arises when applications accept user-supplied dates without validating that the date fields are within supported ranges, particularly rejecting negative or zero days. Red Hat's advisory confirms the vulnerability and rates it as moderate severity with a CVSS 3.1 base score of 6.5. The vulnerability does not impact confidentiality but affects integrity and availability with low impact. Red Hat has released updates for affected packages in Red Hat Enterprise Linux 8 and related products.

The vulnerability can cause corrupted date outputs leading to logic errors in applications using GLib's date/time functions, potentially resulting in denial of service. There is no direct confidentiality impact. The denial of service is due to application logic errors triggered by corrupted date data, not a crash in production environments except under Address Sanitizer builds. The flaw requires no privileges or user interaction and can be exploited remotely via network vectors if the application processes untrusted date inputs.

Red Hat has released security updates addressing this vulnerability. Users should apply the available patches for their GLib packages as provided in the Red Hat advisory RHSA-2026:49512. Additionally, applications processing user-supplied dates should implement input validation to ensure dates are within supported ranges before calling g_date_time_add_full, specifically rejecting inputs that produce negative or zero day fields. No other mitigations are indicated by the vendor advisory.