Skip to main content

GNU C Library CVE-2026-18374

| EUVDEUVD-2026-67222 MEDIUM
Out-of-bounds Write (CWE-787)
2026-08-27 GHSA-qg52-8pr2-xj9v
Buffer Overflow Memory Corruption Suse
4.9
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
4.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
4.9 MEDIUM

Local vector and high complexity because exploitation depends on an application forwarding attacker-controlled input to the fopen ccs= parameter; no elevated attacker privileges are required.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Patch available
Aug 27, 2026 - 22:03 EUVD
CVSS changed
Aug 27, 2026 - 20:37 NVD
4.9 (MEDIUM)
Analysis Generated
Aug 27, 2026 - 20:17 vuln.today
CVE Published
Aug 27, 2026 - 19:53 oss-security
MEDIUM

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Heap buffer overflow in GNU C Library (glibc) 2.45 and earlier triggers when an effectively empty string is passed via the ,ccs= mode-argument extension to fopen(), enabling limited heap memory corruption in applications that expose this code path to externally controlled input. The vendor-assigned CVSS 3.1 score of 4.9 (Medium) with a local attack vector and high complexity accurately reflects the narrow preconditions required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following specific conditions: (1) the target system runs glibc version 2.45 or earlier; (2) a vulnerable application calls fopen() with a mode string that includes the ,ccs= extension; (3) the ccs= label value is derived from attacker-controlled input without validation, and an empty string can be supplied. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is substantially lower than the product's ubiquity might initially suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is upgrading glibc to the patched version that resolves commit 129d706d77587e4d6627cc1ebef9be0f7cbc65f0; however, no specific patched release version number is confirmed in the provided input data - the exact fix version must be verified against the upstream advisory at https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD and the oss-security disclosure at https://seclists.org/oss-sec/2026/q3/602. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-18374 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy