The vulnerability in GLib's g_regex_replace function occurs when the G_REGEX_RAW compile flag is used alongside case-change replacement escapes (\u, \l, \U, \L). The string_append function processes matched substrings with UTF-8 functions that expect valid UTF-8 input, but when the string is treated as raw bytes, this assumption leads to a buffer over-read of 1-5 bytes. This can cause minor information disclosure and denial of service due to application crashes when the over-read crosses a page boundary. The issue specifically affects applications that allow user-controlled replacement strings containing these case-change escapes. Mitigation involves sanitizing or rejecting such inputs or removing the G_REGEX_RAW flag.

An attacker can cause a minor information disclosure of 1-5 bytes by triggering a buffer over-read in GLib's g_regex_replace function. Additionally, a denial of service can occur if the buffer over-read crosses an unmapped page boundary, leading to application crashes. The confidentiality impact is low, integrity impact is none, and availability impact is low. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

To mitigate this vulnerability, implement strict input validation to sanitize or reject user-supplied replacement strings containing case-change modifiers (\u, \l, \U, \L) before calling g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag. Alternatively, removing the G_REGEX_RAW flag or hardcoding replacement strings will fully neutralize the issue. A security update fixing this vulnerability is available from Red Hat for affected products; applying this update is recommended.