CVE-2026-58012 Details

A buffer over-read vulnerability has been identified in GLib's g_regex_replace function. This issue arises when the G_REGEX_RAW compile flag is used in conjunction with case-change replacement escapes. The vulnerability occurs because the string_append function handles matched substrings with UTF-8 functions that expect valid UTF-8 input, even though the string is treated as raw bytes. As a result, this flaw can lead to a minor information disclosure of 1-5 bytes and cause a denial-of-service condition when the buffer over-read crosses a page boundary.

To address this vulnerability, users can validate and sanitize user-supplied replacement strings to ensure they do not contain case-change modifiers before using g_regex_replace or g_regex_replace_eval with the G_REGEX_RAW flag. Alternatively, removing the G_REGEX_RAW flag or hardcoding replacement strings can completely mitigate the issue.