The vulnerability exists in the g_io_channel_read_line_backend() function within giochannel.c of GLib. When an application sets a custom line terminator string longer than one byte via g_io_channel_set_line_term() and then calls g_io_channel_read_line_backend(), memcmp reads beyond the allocated GString buffer, causing a buffer over-read. This can disclose up to 7 bytes of memory or cause a denial of service through application crash if the over-read crosses an unmapped page boundary. The issue is confirmed by Red Hat and tracked under Bugzilla 2492248. The CVSS v3.1 base score is 6.5 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low confidentiality and availability impacts. Red Hat has issued advisories and updates addressing this vulnerability.

An attacker can cause a minor information disclosure of up to 7 bytes of memory or trigger a denial of service by crashing the application using GLib's g_io_channel_read_line_backend() function with a multi-byte custom line terminator. The information disclosure could potentially aid in bypassing protection mechanisms like ASLR. The denial of service impact is considered low as crashes are reliably reproducible in ASan builds but not typically in production environments.

To mitigate this vulnerability, applications should restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators completely neutralizes the issue. Red Hat has released security updates for affected packages, and applying these official patches is recommended. Check the Red Hat advisory for details on applying updates. No other specific mitigations are required.