The vulnerability exists in the GLib library's g_dbus_node_info_new_for_xml() function within gio/gdbusintrospection.c. When processing malformed D-Bus introspection XML containing a 'node' element nested improperly within elements such as 'method', 'signal', 'property', or 'arg', an unsigned integer underflow can occur. This leads to an out-of-bounds read, causing a denial of service condition. The issue affects GLib versions >=9.0 <9.8.2 and >=10.0 <10.2.14. Red Hat advisories RHSA-2026:42063 and RHSA-2026:42089 provide patches for Red Hat Enterprise Linux 9 and 10 variants. The CVSS v3.1 base score is 7.5 (High), with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation results in denial of service due to out-of-bounds memory access caused by integer underflow when processing malformed XML. There is no confidentiality or integrity impact reported. The vulnerability can be triggered remotely without authentication or user interaction.

Official patches are available from Red Hat for affected GLib versions as detailed in advisories RHSA-2026:42063 and RHSA-2026:42089. Users should apply these updates promptly to remediate the vulnerability. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigations are specified by the vendor.