CVE-2026-58012
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A flaw was found in GLib where a buffer over-read occurs in the g_regex_replace function when using the G_REGEX_RAW compile flag and case-change replacement escapes. The string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This can lead to minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
Risk Assessment
The risk for the organization includes potential disclosure of a small amount of data (1-5 bytes) and the possibility of service disruption (DoS) when the buffer over-read crosses a page boundary.
Recommendation
It is recommended to immediately update the GLib library to a version that fixes this vulnerability. Also, avoid using the G_REGEX_RAW flag with the g_regex_replace function until a patch is applied.
Other vulnerabilities in GLib
See all- CVE-2024-34397Medium
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1, where a GDBus-based client subscribing to signals from a trusted system service on a shared computer can receive spoofed D-Bus signals from other users of the same computer.
- CVE-2024-52533Medium
In GNOME GLib before 2.82.1, the file gio/gsocks4aproxy.c has an off-by-one error leading to a buffer overflow because SOCKS4_CONN_MSG_LEN is insufficient for a trailing null character.
- CVE-2026-15588Medium
Denial of Service and resource exhaustion vulnerability in the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated attacker can send excessively long data streams, causing massive memory and CPU consumption, potentially leading to a crash or system hang.
- CVE-2026-58016High
A flaw in GLib's g_dbus_node_info_new_for_xml() function when processing malformed D-Bus introspection XML can cause an unsigned integer overflow and out-of-bounds read, leading to denial of service.
- CVE-2026-58015Medium
In GLib, the D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data.
- CVE-2026-58014High
An off-by-one error was found in GLib's g_key_file_get_locale_string_list function in gkeyfile.c when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
- CVE-2026-58013Medium
A flaw was found in GLib where a buffer over-read occurs in g_io_channel_read_line_backend() in giochannel.c when a custom line terminator longer than one byte is set, causing memcmp to read past the GString buffer. This vulnerability can lead to minor information disclosure of 7 bytes or denial of service if the over-read crosses a page boundary.
- CVE-2026-58011Medium
A flaw was found in GLib where an out-of-bounds read of 2 bytes occurs in the g_date_time_get_ymd function in glib/gdatetime.c when processing an invalid GDateTime object created by g_date_time_add_full. This can corrupt date output and cause logic errors.
- CVE-2026-58010Medium
An off-by-one error was found in GLib in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c. The bounds check uses > instead of >=, causing an out-of-bounds read of one byte during alignment padding checks. This flaw can lead to minor information disclosure of one byte and denial of service if the read crosses a page boundary.
- CVE-2025-14512Medium
A flaw in glib allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in the GIO escape_byte_string() function when processing malicious file or remote filesystem attribute values.
Original NVD description (English source)
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.