Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Rejected reason: REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been discovered that no NIS+ client or server was ever released for any Linux-based OS distributions and as such this makes the API provisional and unused. Secondly it has been discovered that the NIS+ cold start cache (/var/nis/NISCOLDSTART) cannot be bypassed and as such the API can only be called with a trusted server from the pre-populated cache. The use of a trusted server means no trust boundary is crossed and this is therefore considered a normal bug.
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
iconv crash due to assertion failure with untrusted input
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
Last updated 30 June 2026
Buffer overread in nsprintrrf with corrupted RDATA field
Assertion failure in the DNS stub resolver with a long search domain
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.
Stack overflow in nscd due to unbounded alloca use
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Non-progress DoS in SHIFTJISX0213 -> UCS-4 conversion state <br/> handling (iconvdata/shiftjisx0213.c): crafted input can cause repeated <br/> emission of a buffered code point without further input consumption, <br/> leading to persistent retry churn and denial of service in callers <br/> converting untrusted text.<br/> Requirements to exploit: An attacker must be able to supply text that an <br/> application converts from SHIFTJISX0213 to UCS-4, trigger a 2-byte <br/> sequence that expands through jisx0213toucscombining, and have the <br/> caller retry after E2BIG with the same conversion state once only enough <br/> output space remains for the first of the two emitted code points. <br/> Applications that never use this conversion path, or that abort on repeated <br/> no-progress E2BIG, are not practically exposed.<br/>
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.
This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.
When expanding paths that begin with a tilde (~) followed by a username, the internal parsetilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process.
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.
Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.
The resolver truncates the search list when copying it into the fixed-size res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.
There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.
Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.
One-byte overread in strncasecmp on Power8
Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the wewordv member, which on subsequent calls to wordfree may abort the process.
Hello,
The following security advisory has been published:
GLIBC-SA-2026-0004: ===================
nscd client crash on x8664 under high nscd load (CVE-2026-3904)
Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x8664 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash.
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0005 ================== gethostbyaddr and gethostbyaddrr may incorrectly handle DNS response
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
A defect in the getanswerptr function, which implements the iteration and extraction of the answer from the DNS response, can cause it to incorrectly transition from the answer section to the next section while still treating it as an answer to the question. This can happen when the answer contains only skipped records, and the subsequent section contains a semantically invalid TPTR record. This is considered a security issue because it is a violation of the DNS specification that leads to incorrect behaviour that could result in the wrong hostname being returned to the caller. At the time of publication, no known affected DNS server returns results that would be incorrectly interpreted by the library. An attacker would either need to be network adjacent or have compromised the DNS server to use this defect to hide returned reverse DNS results from intrusion detection systems. Even then, the inbound connection from the attacker, or the outbound connection from the application, would be visible to the intrusion detection system. At best, the defect can be used to obfuscate and delay analysis of the evolving threat.
CVE-Id: CVE-2026-4437 Public-Date: 2026-03-20 Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0 () proton me Reported-by: Kevin Farrell
GLIBC-SA-2026-0006 ================== gethostbyaddr and gethostbyaddrr return invalid DNS hostnames
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
A defect in the getanswerptr function, which implements the iteration and extraction of the answer from a DNS response, can cause it to accept an invalid DNS hostname that can contain shell metacharacters. An application that uses the returned hostname in a shell, without guarding for shell expansion, may be subject to shell injection attacks. At the time of publication, no known affected DNS server returns results with shell metacharacters in the results. An attacker would either need to be network adjacent or have compromised the DNS server to use this defect for shell injection. No known vulnerable application has been identified.
CVE-Id: CVE-2026-4438 Public-Date: 2026-03-20 Vulnerable-Commit: 32e5db37684ffcbc6ae34fcc6cdcf28670506baa (2.34-323) Vulnerable-Commit: def97e7f71a07517810f7263213d607e08ad21f1 (2.35-188) Vulnerable-Commit: 77f523c473878ec0051582ef15161c6982879095 (2.36-30) Vulnerable-Commit: e32547d661a43da63368e488b6cfa9c53b4dcf92 (2.37) Reported-by: Antonio Maini (0rbitingZer0) - 0rbitingZer0 () proton me
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0008: =================== Static buffer overflow in deprecated nislocalprincipal
The obsolete nislocalprincipal function in the GNU C Library version 2.43 and older may overflow a buffer in the data section, which could allow an attacker to spoof a crafted response to a UDP request generated by this function and overwrite neighboring static data in the requesting application.
NIS support is obsolete and has been deprecated in the GNU C Library since version 2.26 and is only maintained for legacy usage. Applications should port away from NIS to more modern identity and access management services.
CVE-Id: CVE-2026-5358 Public-Date: 2026-04-10 Reported-by: Rahul Hoysala
GLIBC-SA-2026-0009: =================== scanf %mc off-by-one heap buffer overflow
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
The bug is in the buffer growth formula in vfscanfinternal, which under-allocates by one byte during realloc expansion, allowing a controlled single-byte overwrite past the end of the heap buffer.
The impact is limited by the fact that to execute the overwrite you need both user controlled input data and a specific choice of maximum width that yields a smaller than needed allocation. The latter point has to take into account malloc's particular chunk size rounding process. The "%[width]mc" format specififer does not appear to have notable use in major Linux-based OS distributions, due to which the real world impact may be limited to bespoke use cases.
CVE-Id: CVE-2026-5450 Public-Date: 2026-03-19 Vulnerable-Commit: 874aa52349cc111d1f6ea5dff24bb14c306714e0 (2.7) Reported-by: Rocket Ma
GLIBC-SA-2026-0010: =================== Potential buffer under-read in ungetwc
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (IOwdefaultpbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->IOreadptr) instead of the actual wide-stream read pointer (fp->widedata->IOreadptr). The program crash may happen in cases where fp->IOreadptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
CVE-Id: CVE-2026-5928 Public-Date: 2026-03-17 Reported-by: Rocket Ma Vulnerable-Commit: d64b6ad07585b8a37e5fecc9a47fcee766d52ede (2.1.1-89)
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0011: =================== Potential buffer overflow in nssprintrrf TSIG handling path
The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
A defect in the TSIG case handling within nssprintrrf performs a formatted write using sprintf without checking the remaining buffer length, and may write up to 6 bytes past the end of the buffer. If the library is compiled with assertions, and the out-of-bounds write doesn't terminate the process, then a subsequent check for "len <= buflen" will trigger an assertion failure.
These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 (2021-08-02) and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
CVE-Id: CVE-2026-5435 Public-Date: 2026-04-02 Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2) Reported-by: shinobu
GLIBC-SA-2026-0012: =================== Buffer overread in nsprintrrf with corrupted RDATA field
The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.
These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
CVE-Id: CVE-2026-6238 Public-Date: 2026-04-11 Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.2)
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0024: ===================
One-byte overread in strncasecmp on Power8
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
CVE Id: CVE-2026-97399 Public-Date: 2026-09-28 Vulnerable-Commit: c8376f3e07602aaef9cb843bb73cb5f2b860634a (2.23.90-474) CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - 3.7 Reported-by: AISLE in partnership with Red Hat
Notes: ======
Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD
The following security advisories have been published:
GLIBC-SA-2026-0026: =================== BIG-HKSCS decoding hang on crafted input
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
When decoding input in the BIG5-HKSCS character set, four double-byte sequences map to two Unicode code points each (for example, 0x88 0x62 maps to U+00CA U+0304). The BIG5-HKSCS gconv step emits the first code point and saves the second one in the converter state, to be emitted on the following call. After emitting the saved second code point the step failed to clear the converter state. As a result, when such a sequence is decoded, subsequent calls repeatedly re-emit the saved second code point and consume no input. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input and encoding must be attacker controlled.
CVE-Id: CVE-2026-122054 Public-Date: 2020-03-27 Vulnerable-Commit: f22bc486c1ce5e92380a0d06b98fbba639d170e4 (2.17.90-786) Fix-Commit: c580e6466d6da8262820cdbad19f32c5546226cf (2.32) CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 5.9 Reported-By: Tom Honermann