ZeroDay Findings
Sign inSign up

Findings

CVE-2026-58012

A flaw was found in GLib.

Published Jun 30, 2026 · updated Oct 14, 2026 · gnome glib

A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 30, 2026 · NIST NVD

    Detected

    A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a den

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a den

Affected

  • cpe gnome/glibversion unspecified
  • cpe gnome/glib2.88.0
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux6.0
  • cpe redhat/enterprise linux7.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0

Sources

  • CVE.orgCVE-2026-58012

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-58012

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDCVE-2026-58012

    A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 i

    nvd.nist.gov

References