CVE-2026-18374: Buffer Overflow
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If you process user-supplied values for the `ccs` syntax extension in the `mode` argument to `fopen`, validate them before use. Specifically, avoid passing an effectively empty string to the `,ccs=` extension (e.g., reject/normalize empty `,ccs=`) to prevent the heap buffer overflow described for glibc version 2.45 or earlier.
GNU C Library (glibc) fopen (mode argument with ,ccs= extension) Input validation/allowlisting for the `ccs` syntax extension = Validate attacker-controlled `ccs` so empty strings (effectively empty `,ccs=`) are rejected/rewritten to a safe value; do not pass `ccs` through without validation
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Exposure is limited to applications that use GNU C Library 2.45 or earlier, call fopen with the ,ccs= mode-string extension, and allow an attacker to influence the mode string. The affected usage pattern is not seen in applications in common GNU/Linux distributions.
What input is required to trigger the issue?
An attacker must be able to control the fopen mode-string input and cause an effectively empty value to be passed through the ,ccs= extension. No privileges or user interaction are required according to the supplied vector, but exploitation has high attack complexity and requires local access.
What should be done if an application accepts user-supplied ccs values?
Do not pass user-supplied ccs values directly into fopen mode strings. Validate and restrict accepted values before constructing the mode string, and reject empty or effectively empty ccs values.