https://seclists.org/oss-sec/2026/q3/602: The GNU C Library security advisory update for 2026-08-27
Published Aug 27, 2026
·Updated
Affected Software
1 affected component
GNU GNU C Library (glibc)<=2.45
Applications using the fopen mode-string ",ccs=" extension are affected only if the mode string is attacker controlled and an effectively empty ccs value can be passed through. The advisory states that this usage pattern is not seen in applications in common GNU or Linux distributions.
The advisory rates the attack vector as local and the attack complexity as high. It indicates that no privileges or user interaction are required, but exploitation depends on controlling the relevant fopen mode-string input.
Validate user-supplied ccs values before incorporating them into an fopen mode string, and do not pass such values through without validation. In particular, prevent effectively empty values from reaching the ",ccs=" syntax.
Review applications using GNU C Library 2.45 or earlier for fopen calls that use the ",ccs=" mode extension. Determine whether any part of that mode string, especially the ccs value, can be influenced by unvalidated attacker-controlled input.