CVE-2026-58012: Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

A heap-buffer-overflow READ vulnerability exists in GLib's gregexreplace() function when used with GREGEXRAW compile flag and case-change replacement escapes (\U, \L, \u, \l). In GREGEXRAW mode, PCRE2 treats the subject string as raw bytes rather than UTF-8. Matched substrings can therefore contain arbitrary byte sequences that are not valid UTF-8. When the replacement string contains case-change escapes (e.g., \U\0 to uppercase the match), the internal stringappend() function processes the matched substring using UTF-8 functions (gutf8getchar(), gutf8nextchar()) which assume valid UTF-8 input. A multi-byte UTF-8 lead byte (e.g., 0xF4 indicating a 4-byte sequence) in the matched data causes these functions to read beyond the heap-allocated buffer.

— Red Hat

Glib: buffer over-read in gregexreplace() via glib/gregex.c:stringappend() and gutf8nextchar()

— Microsoft