Answer in brief
CVE-2026-58012 records a Medium severity (CVSS 6.5) vulnerability in Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char(). The current sources do not mark it as known exploited. The current feed maps GNOME/GLib (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps GNOME/GLib (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| GNOME/GLibgeneric | >=0 <2.86.5 || >=0 <2.88.1 | 2.86.5, 2.88.1 |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-58012 records a Medium severity (CVSS 6.5) vulnerability in Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char(). The current sources do not mark it as known exploited. The current feed maps GNOME/GLib (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps GNOME/GLib (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| GNOME/GLibgeneric | >=0 <2.86.5 || >=0 <2.88.1 | 2.86.5, 2.88.1 |
Published upstream
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 30, 2026
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
Quoted source text, attributed separately from HOL analysis.