Is CVE-2026-58012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58012 being exploited in the wild.

How severe is CVE-2026-58012?

Medium severity, with a CVSS score of 6.5, published 30 June 2026.

Which products and versions are affected?

Gnome Glib All versions since introduction of G_REGEX_RAW with case-change replacement escapes.

Is there a fix for CVE-2026-58012?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58012 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58012?

Check whether you run Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58012: GNOME GLib buffer over-read in g_regex_replace

CVE-2026-58012 · Severity: medium · CVSS 6.5 · Published 2026-06-30

GLib is a fundamental software library used by many Linux applications to handle core data structures and utilities. A flaw in its regular expression processing allows an attacker to trigger a memory error when the library processes specially crafted text. This can lead to a program crash (denial of service) or the accidental exposure of small amounts of sensitive information from the computer's memory.

Technologies: Gnome Glib. Vendors: Gnome.

Quick answers

Is CVE-2026-58012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58012 being exploited in the wild.
How severe is CVE-2026-58012?: Medium severity, with a CVSS score of 6.5, published 30 June 2026.
Which products and versions are affected?: Gnome Glib All versions since introduction of G_REGEX_RAW with case-change replacement escapes.
Is there a fix for CVE-2026-58012?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58012 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58012?: Check whether you run Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-buffer-overflow READ vulnerability exists in GLib's g_regex_replace() function. When the G_REGEX_RAW flag is used, the underlying PCRE2 engine treats strings as raw bytes, which may include invalid UTF-8 sequences. However, if the replacement string contains case-change escapes (such as \U, \L, \u, or \l), the internal string_append() function incorrectly uses UTF-8 functions (g_utf8_get_char and g_utf8_next_char) to process these bytes. If a byte indicates a multi-byte UTF-8 sequence that exceeds the actual allocated buffer size, the library reads 1-5 bytes out-of-bounds. This can result in a crash if the read crosses a page boundary or if AddressSanitizer is active, and it can leak adjacent heap memory into the resulting output string.

Affected products

GNOME GLib All versions since introduction of G_REGEX_RAW with case-change replacement escapes
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10

Timeline

2026-01-30: disclosed: Reported via YesWeHack
2026-06-24: other: Bug reported to Red Hat Bugzilla
2026-06-30: advisory: CVE published by Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.