CVE-2026-58012 is a buffer over-read vulnerability in GLib's g_regex_replace function when invoked with the G_REGEX_RAW compile flag combined with case-change replacement escapes (\u, \l, \U, \L). The vulnerability occurs because the string_append function uses UTF-8 processing functions that assume valid UTF-8 input, even though the string is treated as raw bytes. This can cause reading beyond the intended buffer by 1-5 bytes, potentially disclosing minor information and causing denial of service if the read crosses a page boundary. The vulnerability affects applications that allow user-controlled replacement strings with these case-change escapes under the G_REGEX_RAW flag. Red Hat's advisory confirms the issue, rates it as moderate severity, and provides mitigation guidance. A fix is available via updated packages in Red Hat Enterprise Linux 8 and related products.

The vulnerability can lead to minor information disclosure of 1-5 bytes from memory due to buffer over-read, potentially leaking sensitive data such as memory addresses that could aid in bypassing protection mechanisms like ASLR. Additionally, it can cause a denial of service by crashing the application if the over-read crosses an unmapped memory page boundary. The impact on confidentiality is low, integrity is unaffected, and availability impact is low due to possible application crashes. There are no known exploits in the wild at this time.

Red Hat advises implementing strict input validation to sanitize or reject user-supplied replacement strings containing case-change modifiers (\u, \l, \U, \L) before calling g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag. Completely neutralizing the issue can be achieved by removing the G_REGEX_RAW flag or hardcoding replacement strings. Red Hat has released security updates for affected packages in Red Hat Enterprise Linux 8 and related products. Applying these official patches is the recommended remediation. Patch status is confirmed available via Red Hat advisories.