A global-buffer-overflow (out-of-bounds read) exists in GLib's gdatetimegetymd() function, triggered when operating on an invalid GDateTime object produced by gdatetimeaddfull(). The gdatetimeaddfull() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., gdatetimegetmonth(), gdatetimegetyear()) is subsequently called, the internal gdatetimegetymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.