This vulnerability is a state confusion issue in the GLib library's g_dbus_node_info_new_for_xml() function, triggered by malformed D-Bus introspection XML containing nested 'node' elements within other elements such as 'method', 'signal', 'property', or 'arg'. The flaw causes an unsigned integer underflow (wraparound), which leads to an out-of-bounds read. This can cause a denial of service condition by crashing the affected application. The issue affects GLib versions >=9.0 <9.8.2 and >=10.0 <10.2.14. Red Hat has released patches for their Enterprise Linux 9 and 10 distributions to address this vulnerability. The CVSS 3.1 score of 7.5 reflects a network attack vector with low complexity, no privileges or user interaction required, and an impact limited to availability (denial of service).

Successful exploitation of this vulnerability can cause a denial of service due to out-of-bounds memory reads triggered by malformed XML input. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported at this time.

Official patches are available from Red Hat for affected versions of GLib in Red Hat Enterprise Linux 9 and 10. Users should apply the updates as described in the Red Hat advisories RHSA-2026:42063 and RHSA-2026:42089. The vendor advisory confirms the availability of fixes and recommends updating to patched package versions. No additional mitigation steps are required beyond applying these official updates.