CVE-2026-58012
published 2026-06-30CVE-2026-58012: A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change…
PriorityP341high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
0.32%
24.2th percentile
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | glib | < 2.88.1 | 2.88.1 |
| gnome | glib | < 2.86.5 | 2.86.5 |
| gnome | glib | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in GLib.
ghsa_unreviewed·2026-06-30
CVE-2026-58012 [MEDIUM] CWE-126 A flaw was found in GLib.
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
VulDB
GNOME GLib up to 2.86.4/2.88.0 g_regex_replace buffer over-read (ID 3918 / EUVD-2026-40314)
vuldb·2026-06-30·CVSS 6.5
CVE-2026-58012 [MEDIUM] GNOME GLib up to 2.86.4/2.88.0 g_regex_replace buffer over-read (ID 3918 / EUVD-2026-40314)
A vulnerability was found in GNOME GLib up to 2.86.4/2.88.0 and classified as critical. This issue affects the function g_regex_replace. Such manipulation leads to buffer over-read.
This vulnerability is referenced as CVE-2026-58012. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
Red Hat
glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
vendor_redhat·2026-03-27·CVSS 6.5
CVE-2026-58012 [MEDIUM] CWE-126 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
Statement: Any applications that use g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag and allow user-controlled replacement strings containing case-change escapes (\u, \l, \U, \L) are vuln
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58012 glib2: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58012 [MEDIUM] CVE-2026-58012 glib2: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
CVE-2026-58012 glib2: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ vulnerability exists in GLib's g_regex_replace() function when used with G_REGEX_RAW compile flag and case-change replacement escapes (\U, \L, \u, \l).
In G_REGEX_RAW mode, PCRE2 treats the subject string as raw bytes rather than UTF-8. Matched substrings can therefore contain arbitrary byte sequences that are not valid UTF-8. When the replacement string contains case-change escapes (e.g., \U\0 to uppercase the m
Bugzilla
CVE-2026-58012 mingw-glib2: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58012 [MEDIUM] CVE-2026-58012 mingw-glib2: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
CVE-2026-58012 mingw-glib2: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ vulnerability exists in GLib's g_regex_replace() function when used with G_REGEX_RAW compile flag and case-change replacement escapes (\U, \L, \u, \l).
In G_REGEX_RAW mode, PCRE2 treats the subject string as raw bytes rather than UTF-8. Matched substrings can therefore contain arbitrary byte sequences that are not valid UTF-8. When the replacement string contains case-change escapes (e.g., \U\0 to uppercase
Bugzilla
CVE-2026-58012 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58012 [MEDIUM] CVE-2026-58012 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
CVE-2026-58012 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap-buffer-overflow READ vulnerability exists in GLib's g_regex_replace() function when used with G_REGEX_RAW compile flag and case-change replacement escapes (\U, \L, \u, \l).
In G_REGEX_RAW mode, PCRE2 treats the subject string as raw bytes rather than UTF-8. Matched substrings can therefore contain arbitrary byte sequences that are not valid UTF-8. When the replacement string contains case-change escapes (e.g., \U\0 to uppercase the ma
Bugzilla
CVE-2026-58012 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
bugzilla·2026-06-24·CVSS 6.5
CVE-2026-58012 [MEDIUM] CVE-2026-58012 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
CVE-2026-58012 glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
A heap-buffer-overflow READ vulnerability exists in GLib's g_regex_replace() function when used with G_REGEX_RAW compile flag and case-change replacement escapes (\U, \L, \u, \l).
In G_REGEX_RAW mode, PCRE2 treats the subject string as raw bytes rather than UTF-8. Matched substrings can therefore contain arbitrary byte sequences that are not valid UTF-8. When the replacement string contains case-change escapes (e.g., \U\0 to uppercase the match), the internal string_append() function processes the matched substring using UTF-8 functions (g_utf8_get_char(), g_utf8_next_char()) which assume valid UTF-8 input. A multi-byte UTF-8 lead byte (e.g., 0xF4 indicating a 4-byte sequenc
2026-06-30
Published