https://seclists.org/oss-sec/2026/q3/602: The GNU C Library security advisory update for 2026-08-27

Q: Which applications are most likely to be exposed?

Applications using the fopen mode-string ",ccs=" extension are affected only if the mode string is attacker controlled and an effectively empty ccs value can be passed through. The advisory states that this usage pattern is not seen in applications in common GNU or Linux distributions.

Q: What access does an attacker need to exploit this issue?

The advisory rates the attack vector as local and the attack complexity as high. It indicates that no privileges or user interaction are required, but exploitation depends on controlling the relevant fopen mode-string input.

Q: What can be done if patching is not immediately possible?

Validate user-supplied ccs values before incorporating them into an fopen mode string, and do not pass such values through without validation. In particular, prevent effectively empty values from reaching the ",ccs=" syntax.

Q: How can I determine whether an application may be affected?

Review applications using GNU C Library 2.45 or earlier for fopen calls that use the ",ccs=" mode extension. Determine whether any part of that mode string, especially the ccs value, can be influenced by unvalidated attacker-controlled input.

Published Aug 27, 2026

Updated

Affected Software

1 affected component

GNU GNU C Library (glibc)<=2.45

Frequently Asked Questions

Which applications are most likely to be exposed?

Applications using the fopen mode-string ",ccs=" extension are affected only if the mode string is attacker controlled and an effectively empty ccs value can be passed through. The advisory states that this usage pattern is not seen in applications in common GNU or Linux distributions.

What access does an attacker need to exploit this issue?

The advisory rates the attack vector as local and the attack complexity as high. It indicates that no privileges or user interaction are required, but exploitation depends on controlling the relevant fopen mode-string input.

What can be done if patching is not immediately possible?

Validate user-supplied ccs values before incorporating them into an fopen mode string, and do not pass such values through without validation. In particular, prevent effectively empty values from reaching the ",ccs=" syntax.

How can I determine whether an application may be affected?

Review applications using GNU C Library 2.45 or earlier for fopen calls that use the ",ccs=" mode extension. Determine whether any part of that mode string, especially the ccs value, can be influenced by unvalidated attacker-controlled input.