CVE-2026-5450

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.(CVE-2026-5450)

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.(CVE-2026-5450)

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.(CVE-2026-5450)

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.(CVE-2026-5450)

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.(CVE-2026-5450)

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width (CVE-2026-5450)

Bug Fix(es) and Enhancement(s):

• Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on Rocky Linux 10 [rhel-10] (JIRA:Rocky Linux-174869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width (CVE-2026-5450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width (CVE-2026-5450)

Bug Fix(es) and Enhancement(s):

• glibc: counter overflow in __wcsmbs_clone_conv if setlocale is called (JIRA:Rocky Linux-145156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-5450 in the glibc package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-5450 in the glibc package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-5450 in the glibc package for Root:Debian:13. Multiple fixed versions available.

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width (CVE-2026-5450)

Bug Fix(es) and Enhancement(s):

• Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width (CVE-2026-5450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width (CVE-2026-5450)

Bug Fix(es) and Enhancement(s):

• glibc: counter overflow in __wcsmbs_clone_conv if setlocale is called (JIRA:AlmaLinux-145156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

• CVE-2026-5450: fix off-by-one heap overflow in scanf %mc/%ms allocation
• CVE-2026-5928: fix buffer under-read in _IO_wdefault_pbackfail (ungetwc)

• CVE-2026-5450: fix buffer overflow in scanf %mc [BZ #34008]

These are all security issues fixed in the glibc-2.43-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grype-db-0.54.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues:

• CVE-2026-5928: libio: Fix ungetwc operating on byte stream (bsc#1262464, BZ #33998)
• CVE-2026-5450: stdio-common: Fix buffer overflow in scanf %mc (bsc#1262465, BZ #34008)
• CVE-2026-4046: Use pending character state in IBM1390, IBM1399 character sets (bsc#1261206, BZ #33980)

It was discovered that the GNU C Library iconv function incorrectly handled certain IBM character sets. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-4046)

It was discovered that the GNU C Library DNS functions incorrectly handled certain DNS server responses when using gethostbyaddr or gethostbyaddr_r. An attacker in a privileged network position could possibly use this issue to cause an application to violate DNS specification or obtain incorrect hostname information. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-4437, CVE-2026-4438)

It was discovered that the GNU C Library deprecated debugging functions incorrectly enforced caller-supplied buffer lengths. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5435)

It was discovered that the GNU C Library scanf family of functions contained a heap buffer overflow when processing certain format specifiers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5450)

It was discovered that the GNU C Library ungetwc function incorrectly handled certain character encodings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-5928)

It was discovered that the GNU C Library deprecated debugging functions incorrectly validated DNS response record data. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-6238)