CVE-2026-77117

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

CVE-2026-19542 is a vulnerability in the GNU C Library (glibc). Currently, no detailed description is available.(CVE-2026-19542)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

CVE-2026-19542 is a vulnerability in the GNU C Library (glibc). Currently, no detailed description is available.(CVE-2026-19542)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.(CVE-2026-18374)

A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791)

• glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368)

• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

Bug Fix(es) and Enhancement(s):

• glibc: Stop shipping glibc32-debuginfo package (in debug channels) [rhel-9] (JIRA:Rocky Linux-219516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791)
• glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368)
• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)
• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

Bug Fix(es) and Enhancement(s):

• glibc: Stop shipping glibc32-debuginfo package (in debug channels) [almalinux-9] (JIRA:AlmaLinux-219516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542)
• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.

Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

• CVE-2026-6368: posix: make wordexp work on a copy of we_wordv when WRDE_APPEND is set and restore the original on non-NOSPACE errors, preventing a use-after-free in wordfree; add tst-wordexp-append regression test
• CVE-2026-77117: iconvdata: clear the pending character in the SHIFT_JISX0213 decoder after emitting it, preventing an infinite conversion loop
• CVE-2026-19542: misc: use a fixed-size node stack with bounds asserts in tdelete to fix an out-of-bounds stack write during rebalancing

Potential buffer overflow in ns_sprintrrf TSIG handling path. (CVE-2026-5435) Buffer overread in ns_printrrf with corrupted RDATA field. (CVE-2026-6238) wordexp with WRDE_APPEND can return or use invalid memory. (CVE-2026-6368) Potential stack-based buffer clash during tilde expansion in wordexp. (CVE-2026-6791) Fix right-justification in strfmon. (CVE-2026-19499) SHIFT_JISX0213 decoding lacks pending character reset. (CVE-2026-77117) EUC_JISX0213 decoding lacks pending character reset. (CVE-2026-80489)

These are all security issues fixed in the glibc-2.44-2.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)

It was discovered that GNU C Library had an out-of-bounds stack array access in the tdelete function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-19542)

It was discovered that GNU C Library incorrectly handled memory when calling wordexp with the WRDE_APPEND flag. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-6368)

It was discovered that GNU C Library had a stack overflow in the wordexp function when expanding paths beginning with a tilde followed by a long username. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-6791)

It was discovered that GNU C Library had a hang in the SHIFT_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-77117)

It was discovered that GNU C Library had a hang in the EUC_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-80489)

USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides the corresponding fixes for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)

It was discovered that GNU C Library had an out-of-bounds stack array access in the tdelete function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-19542)

It was discovered that GNU C Library incorrectly handled memory when calling wordexp with the WRDE_APPEND flag. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-6368)

It was discovered that GNU C Library had a stack overflow in the wordexp function when expanding paths beginning with a tilde followed by a long username. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-6791)

It was discovered that GNU C Library had a hang in the SHIFT_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-77117)

It was discovered that GNU C Library had a hang in the EUC_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-80489)