CVE-2026-5928: Potential buffer under-read in ungetwc
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.42-17
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5928?
CVE-2026-5928 is classified as a medium severity vulnerability due to its potential for causing buffer overflow issues.
How do I fix CVE-2026-5928?
To fix CVE-2026-5928, upgrade the GNU C Library to version 2.44 or later to mitigate the buffer overflow risk.
What are the risks of CVE-2026-5928?
The risks of CVE-2026-5928 include potential crashes and exploitation leading to arbitrary code execution on affected systems.
Which versions of GNU C Library are affected by CVE-2026-5928?
CVE-2026-5928 affects versions of the GNU C Library up to and including version 2.43.
Is CVE-2026-5928 related to file handling vulnerabilities?
Yes, CVE-2026-5928 involves a static buffer overflow that occurs during file handling with wide character encodings.