CVE-2026-58012 is a buffer over-read vulnerability in GLib's g_regex_replace function triggered when the G_REGEX_RAW compile flag is used alongside case-change replacement escapes. The root cause is that string_append uses UTF-8 processing functions that expect valid UTF-8 input, but the input is treated as raw bytes, leading to out-of-bounds reads. This flaw can cause minor information disclosure and denial of service conditions. Red Hat advisories RHSA-2026:49512 and RHSA-2026:55440 confirm the issue and provide patches for affected Red Hat Enterprise Linux 8 and 9 packages.

The vulnerability allows an attacker to cause a minor information disclosure of 1-5 bytes and potentially trigger a denial of service if the buffer over-read crosses a memory page boundary. There is no indication of privilege escalation or remote code execution. No known exploits in the wild have been reported. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, limited confidentiality impact, no integrity impact, and low availability impact.

Official patches are available from Red Hat for affected packages in Red Hat Enterprise Linux 8 and 9. Users should apply the updates referenced in Red Hat advisories RHSA-2026:49512 and RHSA-2026:55440. The advisories provide detailed instructions and updated package versions. No additional mitigations are required beyond applying these official fixes.