MGASA-2026-0581: Updated glibc package fixes security vulnerabilities
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation. (CVE-2026-18374) Stack overflow in nscd due to unbounded alloca use. (CVE-2026-89092) Assertion failure in the DNS stub resolver with a long search domain. (CVE-2026-8674) ATSECURE programs may load attacker-controlled code via $ORIGIN. (CVE-2026-86805) ATSECURE program buffer overflow via $ORIGIN processing. (CVE-2026-95818) Directory traversal via the LANGUAGE environment variable. (CVE-2026-84243)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/glibcto a version that resolves this vulnerability.Fixed in 2.42-11.mga10 - Compensating control
Validate user-supplied values before passing them to the `,ccs=` syntax extension; do not pass attacker-controlled string input through without validation.
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which applications are most likely to be exposed to the fopen issue?
Applications that pass attacker-controlled input as the ccs value in fopen mode strings are exposed to this issue in GNU C Library 2.45 or earlier. The advisory states that this usage pattern is not seen in applications in common GNU/Linux distributions.
What input conditions are required for the fopen overflow?
An attacker must be able to control the fopen mode string and cause an effectively empty value to be passed through the ,ccs= syntax extension. User-supplied ccs values should not be passed through without validation.
What should be reviewed if patching cannot happen immediately?
Review application code for fopen mode strings using ,ccs= and validate or reject untrusted ccs values before constructing the mode string. Also identify uses of nscd, DNS resolver configurations with long search domains, AT_SECURE programs using $ORIGIN, and processing of the LANGUAGE environment variable.
How can teams determine whether the fopen issue applies to their code?
Search for fopen calls that construct the mode argument from externally supplied data, especially where the mode includes ,ccs=. The issue applies when that input can produce an effectively empty ccs value.