Skip to main content

Glibc CVE-2026-0861

HIGH
Integer Overflow or Wraparound (CWE-190)
2026-01-14 3ff69d7a-14f2-4f67-a097-88dee7810d18
Buffer Overflow Integer Overflow Red Hat Glibc Suse Gnu
High
Disputed · 8.4 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Call memalign with large alignment value
  2. Delivery
    Supply size near PTRDIFF_MAX
  3. Exploit
    Trigger integer overflow in size_t
  4. Execution
    Corrupt heap memory
  5. Impact
    Execute arbitrary code

Vulnerability Assessment

Weakness
CWE
CWE-190
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker must control both size and alignment arguments to memalign/posix_memalign/aligned_alloc functions. Size parameter must be close to PTRDIFF_MAX. Alignment must exceed 2^62+1. Requires local code execution context in application using GNU C Library 2.30-2.42.
Impact

CVSS 8.4 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to an integer overflow, which could consequently result in a heap corruption.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Glibc versions 2.30 through 2.42 contain an integer overflow in the memalign function family that allows attackers with control over both size and alignment parameters to trigger heap corruption. Public exploit code exists for this vulnerability, which requires carefully crafted inputs with alignment values between 2^62+1 and 2^63 paired with sizes near PTRDIFF_MAX. Local attackers exploiting this flaw could achieve code execution or denial of service on affected systems.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 8.4

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. [CVSS 8.4 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-190 (Integer Overflow or Wraparound). Affects Glibc. Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment

Know when Glibc gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
NVD PRIMARY 8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.1 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
PoC Detected
Feb 03, 2026 - 18:26 vuln.today
Public exploit code
Patch released
Feb 03, 2026 - 18:26 nvd
Patch available
CVE Published
Jan 14, 2026 - 21:15 nvd
HIGH 8.4

DescriptionCVE.org

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.

Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Executive ViewAI

Why It Matters

Organizations using the GNU C Library face notable risk from CVE-2026-0861, a integer overflow vulnerability rated CVSS 8.4. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

62
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Affected Products (CPE)CVE.org

cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*

More in Glibc

View all
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2024-2961 HIGH POC
7.3 Apr 17

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
CVE-2015-7547 HIGH POC
8.1 Feb 18

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
CVE-2023-6246 HIGH POC
8.4 Jan 31

Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
CVE-2014-5119 HIGH POC
7.5 Aug 29

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
CVE-2012-4412 HIGH POC
7.5 Oct 09

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
CVE-2018-1000001 HIGH POC
7.8 Jan 31

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
CVE-2019-9169 CRITICAL POC
9.8 Feb 26

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
CVE-2019-1010022 CRITICAL POC
9.8 Jul 15

GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2021-33574 CRITICAL POC
9.8 May 25

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
CVE-2023-25139 CRITICAL POC
9.8 Feb 03

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container private-registry/harbor-core:1.1.1-1.24 Container private-registry/harbor-exporter:1.1.1-1.24 Container private-registry/harbor-jobservice:1.1.1-1.24 Container private-registry/harbor-portal:1.1.1-1.25 Container private-registry/harbor-registry:1.1.1-1.24 Container private-registry/harbor-registryctl:1.1.1-1.24 Container private-registry/harbor-trivy-adapter:1.1.1-1.27 Container suse/manager/5.0/x86_64/proxy-httpd:latest Container suse/manager/5.0/x86_64/proxy-salt-broker:latest Container suse/manager/5.0/x86_64/proxy-squid:latest Container suse/manager/5.0/x86_64/proxy-ssh:latest Container suse/manager/5.0/x86_64/proxy-tftpd:latest Container suse/manager/5.0/x86_64/server-attestation:latest Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:latest Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.2.9.13.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-tftpd:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.2.8.15.2 Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image pr_15_7 Image proxy-httpd-image Image proxy-salt-broker-image Image proxy-squid-image Image proxy-ssh-image Image proxy-tftpd-image Image server-attestation-image Image server-hub-xmlrpc-api-image Image server-migration-14-16-image Image server-saline-image Affected
Container rancher/elemental-channel/sl-micro:6.0-baremetal Container rancher/elemental-channel/sl-micro:6.0-base Container rancher/elemental-channel/sl-micro:6.0-kvm Container rancher/elemental-channel/sl-micro:6.0-rt Container suse/sl-micro/6.0/baremetal-iso-image:2.1.4-6.124 Container suse/sl-micro/6.0/base-iso-image:2.1.4-5.124 Container suse/sl-micro/6.0/kvm-iso-image:2.1.4-6.130 Container suse/sl-micro/6.0/rt-iso-image:2.1.4-6.125 Container suse/sl-micro/6.1/baremetal-iso-image:2.2.1-5.70 Container suse/sl-micro/6.1/base-iso-image:2.2.1-5.86 Container suse/sl-micro/6.1/kvm-iso-image:2.2.1-5.97 Container suse/sl-micro/6.1/rt-iso-image:2.2.1-5.74 Affected
Container suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.23 Container suse/manager/4.3/proxy-salt-broker:4.3.16.2.9.63.24 Container suse/manager/4.3/proxy-squid:4.3.16.2.9.72.18 Container suse/manager/4.3/proxy-ssh:4.3.16.2.9.63.17 Container suse/manager/4.3/proxy-tftpd:4.3.16.2.9.63.18 Affected
Container suse/manager/5.0/x86_64/server-migration-14-16:latest Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.2.8.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.2.6.13.1 Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image server-database-migration-image Image server-postgresql-image Affected
Container suse/manager/5.0/x86_64/server:latest Container suse/multi-linux-manager/5.1/x86_64/server:5.1.2.8.13.2 Image server-image Affected

References

Advisories & patches
PATCH http://www.openwall.com/lists/oss-security/2026/01/16/5 PATCH https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001 ADVISORY https://access.redhat.com/errata/RHSA-2026:1334 ADVISORY https://access.redhat.com/errata/RHSA-2026:2786 ADVISORY https://access.redhat.com/errata/RHSA-2026:3228 ADVISORY https://access.redhat.com/errata/RHSA-2026:4501 ADVISORY https://access.redhat.com/errata/RHSA-2026:4655 ADVISORY https://access.redhat.com/errata/RHSA-2026:4943 ADVISORY https://access.redhat.com/errata/RHSA-2026:5606 ADVISORY https://vuldb.com/?id.341236 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0347/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0371/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0499/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0827/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0896/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20178/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20198/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20527/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20536/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20544/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20563/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20608/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy