Executive brief
GLib is a fundamental software library used by many Linux applications to handle core data structures and utilities. A flaw in its regular expression processing allows an attacker to trigger a memory error when the library processes specially crafted text. This can lead to a program crash (denial of service) or the accidental exposure of small amounts of sensitive information from the computer's memory.
Technical details
A heap-buffer-overflow READ vulnerability exists in GLib's g_regex_replace() function. When the G_REGEX_RAW flag is used, the underlying PCRE2 engine treats strings as raw bytes, which may include invalid UTF-8 sequences. However, if the replacement string contains case-change escapes (such as \U, \L, \u, or \l), the internal string_append() function incorrectly uses UTF-8 functions (g_utf8_get_char and g_utf8_next_char) to process these bytes. If a byte indicates a multi-byte UTF-8 sequence that exceeds the actual allocated buffer size, the library reads 1-5 bytes out-of-bounds. This can result in a crash if the read crosses a page boundary or if AddressSanitizer is active, and it can leak adjacent heap memory into the resulting output string.
Affected products
- GNOME GLib All versions since introduction of G_REGEX_RAW with case-change replacement escapes
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-01-30: disclosed: Reported via YesWeHack
- 2026-06-24: other: Bug reported to Red Hat Bugzilla
- 2026-06-30: advisory: CVE published by Red Hat