CVE-2026-18374

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.(CVE-2026-18374)

A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.(CVE-2026-18374)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.(CVE-2026-18374)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.(CVE-2026-18374)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.(CVE-2026-18374)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791)

• glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368)

• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

Bug Fix(es) and Enhancement(s):

• glibc: Stop shipping glibc32-debuginfo package (in debug channels) [rhel-9] (JIRA:Rocky Linux-219516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791)
• glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368)
• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)
• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

Bug Fix(es) and Enhancement(s):

• glibc: Stop shipping glibc32-debuginfo package (in debug channels) [almalinux-9] (JIRA:AlmaLinux-219516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)
• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.

This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

These are all security issues fixed in the glibc-2.44-2.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).