Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Rejected reason: REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been discovered that no NIS+ client or server was ever released for any Linux-based OS distributions and as such this makes the API provisional and unused. Secondly it has been discovered that the NIS+ cold start cache (/var/nis/NISCOLDSTART) cannot be bypassed and as such the API can only be called with a trusted server from the pre-populated cache. The use of a trusted server means no trust boundary is crossed and this is therefore considered a normal bug.
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
iconv crash due to assertion failure with untrusted input
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
Last updated 30 June 2026
Last updated 30 June 2026
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process.
Hello,
The following security advisory has been published:
GLIBC-SA-2026-0004: ===================
nscd client crash on x8664 under high nscd load (CVE-2026-3904)
Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x8664 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash.
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0005 ================== gethostbyaddr and gethostbyaddrr may incorrectly handle DNS response
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
A defect in the getanswerptr function, which implements the iteration and extraction of the answer from the DNS response, can cause it to incorrectly transition from the answer section to the next section while still treating it as an answer to the question. This can happen when the answer contains only skipped records, and the subsequent section contains a semantically invalid TPTR record. This is considered a security issue because it is a violation of the DNS specification that leads to incorrect behaviour that could result in the wrong hostname being returned to the caller. At the time of publication, no known affected DNS server returns results that would be incorrectly interpreted by the library. An attacker would either need to be network adjacent or have compromised the DNS server to use this defect to hide returned reverse DNS results from intrusion detection systems. Even then, the inbound connection from the attacker, or the outbound connection from the application, would be visible to the intrusion detection system. At best, the defect can be used to obfuscate and delay analysis of the evolving threat.
CVE-Id: CVE-2026-4437 Public-Date: 2026-03-20 Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0 () proton me Reported-by: Kevin Farrell
GLIBC-SA-2026-0006 ================== gethostbyaddr and gethostbyaddrr return invalid DNS hostnames
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
A defect in the getanswerptr function, which implements the iteration and extraction of the answer from a DNS response, can cause it to accept an invalid DNS hostname that can contain shell metacharacters. An application that uses the returned hostname in a shell, without guarding for shell expansion, may be subject to shell injection attacks. At the time of publication, no known affected DNS server returns results with shell metacharacters in the results. An attacker would either need to be network adjacent or have compromised the DNS server to use this defect for shell injection. No known vulnerable application has been identified.
CVE-Id: CVE-2026-4438 Public-Date: 2026-03-20 Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0 () proton me
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0008: =================== Static buffer overflow in deprecated nislocalprincipal
The obsolete nislocalprincipal function in the GNU C Library version 2.43 and older may overflow a buffer in the data section, which could allow an attacker to spoof a crafted response to a UDP request generated by this function and overwrite neighboring static data in the requesting application.
NIS support is obsolete and has been deprecated in the GNU C Library since version 2.26 and is only maintained for legacy usage. Applications should port away from NIS to more modern identity and access management services.
CVE-Id: CVE-2026-5358 Public-Date: 2026-04-10 Reported-by: Rahul Hoysala
GLIBC-SA-2026-0009: =================== scanf %mc off-by-one heap buffer overflow
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
The bug is in the buffer growth formula in vfscanfinternal, which under-allocates by one byte during realloc expansion, allowing a controlled single-byte overwrite past the end of the heap buffer.
The impact is limited by the fact that to execute the overwrite you need both user controlled input data and a specific choice of maximum width that yields a smaller than needed allocation. The latter point has to take into account malloc's particular chunk size rounding process. The "%[width]mc" format specififer does not appear to have notable use in major Linux-based OS distributions, due to which the real world impact may be limited to bespoke use cases.
CVE-Id: CVE-2026-5450 Public-Date: 2026-03-19 Vulnerable-Commit: 874aa52349cc111d1f6ea5dff24bb14c306714e0 (2.7) Reported-by: Rocket Ma
GLIBC-SA-2026-0010: =================== Potential buffer under-read in ungetwc
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (IOwdefaultpbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->IOreadptr) instead of the actual wide-stream read pointer (fp->widedata->IOreadptr). The program crash may happen in cases where fp->IOreadptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
CVE-Id: CVE-2026-5928 Public-Date: 2026-03-17 Reported-by: Rocket Ma Vulnerable-Commit: d64b6ad07585b8a37e5fecc9a47fcee766d52ede (2.1.1-89)
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0011: =================== Potential buffer overflow in nssprintrrf TSIG handling path
The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
A defect in the TSIG case handling within nssprintrrf performs a formatted write using sprintf without checking the remaining buffer length, and may write up to 6 bytes past the end of the buffer. If the library is compiled with assertions, and the out-of-bounds write doesn't terminate the process, then a subsequent check for "len <= buflen" will trigger an assertion failure.
These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 (2021-08-02) and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
CVE-Id: CVE-2026-5435 Public-Date: 2026-04-02 Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2) Reported-by: shinobu
GLIBC-SA-2026-0012: =================== Buffer overread in nsprintrrf with corrupted RDATA field
The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.
These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
CVE-Id: CVE-2026-6238 Public-Date: 2026-04-11 Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2)
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD