CVE-2026-58012 is a buffer over-read vulnerability in GLib's g_regex_replace function when used with the G_REGEX_RAW flag and case-change replacement escapes. The root cause is that string_append uses UTF-8 processing functions on raw byte strings, which can lead to reading beyond the intended buffer. This flaw can disclose a small amount of memory (1-5 bytes) and cause a denial of service if the over-read crosses a page boundary. It affects Red Hat Enterprise Linux 10 as it includes the vulnerable GLib version. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges required, no user interaction, and impact on confidentiality and availability.

The vulnerability allows an attacker to cause a minor information disclosure of 1-5 bytes from memory and potentially trigger a denial of service condition if the buffer over-read crosses a page boundary. There is no indication of integrity impact. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-58012 for current remediation guidance. No official fix or temporary workaround is stated in the provided advisory content. Monitor the vendor advisory for updates and apply patches once available.