Every CVE Search/ Get API key

CVE-2018-6551

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on...

9.8 CriticalFix available

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.21%Up 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
CVE-2018-6551
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-190, CWE-787
Updated
2026-11-02
CVE List No score

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
CVE-2018-6551
Updated
2026-11-02
EUVDEUVD-2018-18303 No score

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
EUVD-2018-18303
Updated
2026-11-03
GitHub AdvisoriesGHSA-39wv-6252-46w2 9.8

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on...

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
GHSA-39wv-6252-46w2
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVBELL-CVE-2018-6551 9.8

CVE-2018-6551 does not affect BellSoft software

Record
BELL-CVE-2018-6551
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
CVE-2018-6551
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2018-6551 9.8

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
DEBIAN-CVE-2018-6551
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-6551 9.8

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Record
UBUNTU-CVE-2018-6551
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0159 No score

Updated glibc packages fix security vulnerability

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption (CVE-2018-6485, CVE-2018-6551).

Record
MGASA-2018-0159
Updated
2026-11-02
OSVSUSE-SU-2018:0451-1 No score

Security update for glibc

This update for glibc fixes the following issues:

Security issues fixed:

  • CVE-2017-8804: Fix memory leak after deserialization failure in xdr_bytes, xdr_string (bsc#1037930)
  • CVE-2017-12132: Reduce EDNS payload size to 1200 bytes (bsc#1051791)
  • CVE-2018-6485,CVE-2018-6551: Fix integer overflows in internal memalign and malloc functions (bsc#1079036)
  • CVE-2018-1000001: Avoid underflow of malloced area (bsc#1074293)

Non security bugs fixed:

  • Release read lock after resetting timeout (bsc#1073990)
Record
SUSE-SU-2018:0451-1
Updated
2026-11-02
OSVSUSE-SU-2018:0565-1 No score

Security update for glibc

This update for glibc fixes the following issues:

Security issues:

  • CVE-2017-8804: Fix memory leak after deserialization failure in xdr_bytes, xdr_string (bsc#1037930)
  • CVE-2017-12132: Reduce EDNS payload size to 1200 bytes (bsc#1051791)
  • CVE-2018-6485,CVE-2018-6551: Fix integer overflows in internal memalign and malloc functions (bsc#1079036)
  • CVE-2018-1000001: Avoid underflow of malloced area in realpath (bsc#1074293)

Also a non security issue was fixed:

  • Do not fail if one of the two responses to AF_UNSPEC fails (bsc#978209)
Record
SUSE-SU-2018:0565-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glibc
Debian:12
 before 2.27-1
2.27-1
glibc
Debian:13
 before 2.27-1
2.27-1
glibc
Debian:14
 before 2.27-1
2.27-1
glibc
Mageia:6
From an advisory covering 2 CVEs
 before 2.22-28.mga6
2.22-28.mga6
glibc
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
Show 9 moreShow less
Affected packages
PackageAffectedFixed
glibc
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 5 CVEs
 before 2.22-62.6.2
2.22-62.6.2
glibc
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 5 CVEs
 before 2.11.3-17.110.6.2
2.11.3-17.110.6.2
glibc
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 5 CVEs
 before 2.11.3-17.110.6.2
2.11.3-17.110.6.2
glibc
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 5 CVEs
 before 2.11.3-17.110.6.2
2.11.3-17.110.6.2
glibc
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 5 CVEs
 before 2.11.3-17.110.6.2
2.11.3-17.110.6.2
glibc
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 5 CVEs
 before 2.11.3-17.110.6.2
2.11.3-17.110.6.2
glibc
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 5 CVEs
 before 2.11.3-17.110.6.2
2.11.3-17.110.6.2

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6551 is a critical vulnerability (CVSS 9.8) in Gnu Glibc, published February 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in glibc 2.27-1.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open