CVE-2026-5450: scanf %mc off-by-one heap buffer overflow
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.42-17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.43 - Configuration
Ensure calls to the scanf family do not use the %mc specifier with a format width explicitly greater than 1024 to avoid the one-byte heap buffer overflow.
GNU C Library (glibc) scanf family scanf format width specifier = Do not use explicit width greater than 1024 with %mc
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5450?
CVE-2026-5450 has a high severity rating due to the potential for a heap buffer overflow leading to unauthorized access or crashes.
How do I fix CVE-2026-5450?
To fix CVE-2026-5450, upgrade your GNU C Library to a version newer than 2.43.
What systems are affected by CVE-2026-5450?
CVE-2026-5450 affects versions of the GNU C Library from 2.7 through 2.43.
What are the potential impacts of CVE-2026-5450?
The potential impacts of CVE-2026-5450 include application crashes and the possibility of remote code execution.
Is CVE-2026-5450 an easily exploitable vulnerability?
CVE-2026-5450 may be exploitable under certain conditions, especially if applications improperly handle user input.