The vulnerability resides in the GLib library's regular expression replacement routine. When the G_REGEX_RAW compile flag is used together with case-change escape sequences, the internal string_append function processes the substitution text as UTF-8 even though it represents raw bytes. This mismatch allows an attacker to read beyond the intended buffer, exposing 1-5 bytes of data and triggering a denial of service if the over-read crosses a page boundary. The weakness is classified as CWE-126, a buffer over-read.

The flaw impacts all Red Hat Enterprise Linux releases that ship the affected GLib package, including RHEL 6, 7, 8, 9, 10, and Red Hat Hardened Images. The vulnerability is tied to the GLib component, which is widely used across system libraries and applications. No specific version is identified, so any installation of GLib running on these operating systems is potentially vulnerable.

The CVSS v3 score of 6.5 places the vulnerability in the medium severity range, and it is not currently listed in the CISA KEV catalog. Because the issue depends on how an application compiles regular expressions and the content of user-supplied replacement strings, the attack vector is likely local or remote where the attacker can influence g_regex_replace calls. Exploitation requires that the application use the G_REGEX_RAW flag and include case-change modifiers; once these conditions are met, an attacker can read a few bytes of arbitrary memory or cause a service crash, potentially impacting confidentiality and availability.