Skip to main content

Glib CVE-2026-58012

| EUVDEUVD-2026-40314 HIGH
Buffer Over-read (CWE-126)
2026-06-30 secalert@redhat.com GHSA-vwg8-37h9-g38g
Buffer Overflow Denial Of Service Information Disclosure Red Hat Enterprise Linux Glib Gnome
8.2
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-126
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 02, 2026

Buffer over-read in GNOME GLib's g_regex_replace() lets remote attackers leak 1-5 adjacent bytes of process memory and crash applications when regex replacement is performed with the G_REGEX_RAW compile flag combined with case-change replacement escapes. The internal string_append helper applies UTF-8 aware routines to matched substrings even though G_REGEX_RAW treats the buffer as raw bytes, reading past the intended boundary. There is no public exploit identified at time of analysis and EPSS is low (0.26%, 18th percentile), but the flaw is broadly reachable because GLib underpins the GNOME stack and ships across Red Hat Enterprise Linux 6-10.

Earlier versions of this analysis (2)
v2 Jul 02, 2026 - 19:46 cvss changed CVSS 8.2

Buffer over-read in GNOME GLib's g_regex_replace() lets remote attackers who can supply regex subject/replacement input to an application trigger a 1-5 byte out-of-bounds memory read and, when the over-read crosses a page boundary, crash the process (denial of service). The flaw is reachable only when the caller compiles the pattern with the G_REGEX_RAW flag and uses case-change replacement escapes, causing GLib's string_append routine to apply UTF-8 processing to bytes that are actually raw. It affects GLib before 2.86.5 and before 2.88.1 (including 2.88.0) and is shipped across Red Hat Enterprise Linux 6-10; a vendor patch is available and no public exploit has been identified at time of analysis.

v1 Jun 30, 2026 - 13:36 CVSS 6.5

Buffer over-read in GLib's g_regex_replace function exposes applications to minor information disclosure and denial of service when two non-default conditions coincide: the G_REGEX_RAW compile flag is active and case-change replacement escapes (e.g., \u, \U, \l, \L) are present in the replacement pattern. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects that a network-facing application using this code path can be triggered by attacker-controlled input without authentication, but real-world impact is constrained by the non-default configuration requirement and the narrow impact window of 1-5 bytes of disclosure. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Affected VersionsENISA

glib 0 <2.86.5
glib 0 <2.88.1

Affected Packages

euvd glib fix: 2.86.5, 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vuln.today AI 4.8 MEDIUM

AV:N since input can be remote, but AC:H because the vulnerable G_REGEX_RAW-plus-case-escape path is non-default and the page-crossing crash is probabilistic; C:L for the 1-5 byte leak, A:L as DoS is conditional not guaranteed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat 6.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 02, 2026 - 19:46 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 02, 2026 - 19:46 vuln.today
v2 - CVSS changed
Severity Changed
Jul 02, 2026 - 19:37 NVD
MEDIUM HIGH
CVSS changed
Jul 02, 2026 - 19:37 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the G_REGEX_RAW compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.

Executive ViewAI

Why It Matters

A buffer over-read vulnerability in GNOME GLib (CVE-2026-58012, CVSS 8.2) affects regex replacement operations across RHEL 6-10 systems, potentially allowing attackers to leak sensitive process memory and crash applications. GLib underpins the core GNOME stack, making this a widespread risk to organizations running Red Hat Enterprise Linux. No public exploit identified at time of analysis, though vendor patch availability enables immediate risk mitigation.

Recommended Action

Within 24 hours: Identify all systems running GNOME GLib across RHEL 6-10 infrastructure and document current versions in use. Within 7 days: Apply vendor-released patches to GNOME GLib across all affected RHEL 6-10 systems via package management (glib2 package family). Within 30 days: Verify patch deployment across inventory, enable application crash monitoring for regex-related failures, and assess any exploitation indicators in system logs.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2022-2124 HIGH POC
7.8
CVE-2022-2175 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sles/16.0/toolbox:latest Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58012 ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/374841 REF https://access.redhat.com/errata/RHSA-2026:49512 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/errata/RHSA-2026:92449 REF https://access.redhat.com/errata/RHSA-2026:92452 REF https://access.redhat.com/security/cve/CVE-2026-58012 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492247 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3918

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy