Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
GNOME GLib — Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U L N H 8.2 .0036 29.5 —
AFFECTED
Product Versions Fixed
GLib unspecified —
Red Hat Enterprise Linux 10 unspecified 0:2.80.4-12.el10_2.21
Red Hat Enterprise Linux 8 unspecified 0:2.70.1-9.el8_10
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 10 unspecified —
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
+ 1 more
TIMELINE
Jun 26 Reserved by redhat
Jun 30 EXPLOIT PUBLISHED — CVE-2026-58012 (GNOME GLib). Public exploit reference added.
Jun 30 Published (CNA: redhat)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-58012 (GNOME GLib). Public exploit reference added.
Aug 17 RESCORED — CVE-2026-58012 (GNOME GLib). CVSS 6.5 → 8.2 (NVD).
Description
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
Lifecycle
Complete event history — 5 events, chronological
| Date | Event | Detail |
|---|
| June 26, 2026 | Reserved | Reserved by redhat |
| June 30, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58012 (GNOME GLib). Public exploit reference added. |
| June 30, 2026 | Published | Published (CNA: redhat) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58012 (GNOME GLib). Public exploit reference added. |
| August 17, 2026 | RESCORED | RESCORED — CVE-2026-58012 (GNOME GLib). CVSS 6.5 → 8.2 (NVD). |
Affected
Affected products and packages — 11 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | GLib | — | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:2.80.4-12.el10_2.21 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | 0:2.70.1-9.el8_10 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
| Red Hat | Red Hat Hardened Images | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-58012 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.