Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A heap-buffer-overflow READ of 1 byte occurs in g_key_file_get_locale_string_list() at gkeyfile.c:2464 when the resolved locale string value is an empty string (""). The function computes len = strlen(value) which yields 0, then accesses value[len - 1]. Since len is gsize(unsigned), len - 1 wraps to SIZE_MAX, causing a read of 1 byte before the heap allocation (under-read). Any application that loads a key file from untrusted input and calls g_key_file_get_locale_string_list() on a key whose value is empty is affected. The key file format is commonly used for .desktop files and application configuration.