A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

A flaw was found in GLib. A buffer over-read can occur in giochannelreadlinebackend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.

A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used with the GREGEXRAW compile flag and case-change replacement escapes because the stringappend function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.

A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the gescapeuristring() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the gdatetimegetymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the gdatetimeaddfull function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.

A GDBus authentication denial-of-service / resource exhaustion flaw has been reported. The vulnerability involves a lack of line length limitations when gdbusauth reads input from a client. This can be exploited by an unauthenticated remote or local attacker to cause excessive memory and CPU consumption.

Heap‑buffer‑overflow vulnerability in the JPEG and Base64 decoding paths of gdk‑pixbuf. The flaw occurs in gdkpixbufjpegimageloadincrement() (io‑jpeg.c:1193:26) when a specially crafted JPEG triggers a flow that leads to gbase64encodestep() in glib (gbase64.c:141:16), reading beyond heap buffer bounds. Exploitation requires no authentication and could lead to application crash or arbitrary code execution via crafted images.

A global-buffer-overflow (out-of-bounds read) exists in GLib's gdatetimegetymd() function, triggered when operating on an invalid GDateTime object produced by gdatetimeaddfull(). The gdatetimeaddfull() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., gdatetimegetmonth(), gdatetimegetyear()) is subsequently called, the internal gdatetimegetymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.

A heap-buffer-overflow READ occurs in giochannelreadlinebackend() at giochannel.c:1831 when a custom line terminator of length > 1 is set via giochannelsetlineterm(). The memcmp call reads linetermlen bytes from nextchar, but the loop condition nextchar < lastchar only guarantees 1 byte is available. When nextchar is within linetermlen - 1 bytes of lastchar, memcmp reads past the GString buffer into ASan redzone / unallocated memory.

The GLib D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. The D-Bus specification explicitly states that cookie context names must not contain the characters /, \, . (period), spaces, or ASCII control characters. However, GLib's client-side code accepts this value verbatim and uses it to construct a filesystem path via gbuildfilename(). A malicious D-Bus server can supply a cookiecontext containing path traversal sequences such as ../.targetfile, causing the client to read an arbitrary file outside the ~/.dbus-keyrings/ directory. The file contents (specifically the third space-separated token of the first matching line) are then incorporated into a SHA1 hash computation and sent back to the server as part of the authentication response. The server can verify guessed file contents against this SHA1 hash, enabling data exfiltration.

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the gdatetimenewfromiso8601() function.