GNU C Library CVE-2026-18374

Exploitation requires all of the following specific conditions: (1) the target system runs glibc version 2.45 or earlier; (2) a vulnerable application calls fopen() with a mode string that includes the ,ccs= extension; (3) the ccs= label value is derived from attacker-controlled input without validation, and an empty string can be supplied. The glibc advisory explicitly states this three-way combination does not appear in common GNU or Linux distribution applications, making standard system binaries non-exploitable. Limiting factors include the local attack vector (AV:L) constraining exploitation to local process influence or physical/logical local access, and the high attack complexity (AC:H) reflecting the narrow conditions. Standard applications using fopen() with hardcoded mode strings (e.g., fopen(path, "r")) are entirely unaffected regardless of glibc version.

Real-world risk is substantially lower than the product's ubiquity might initially suggest. The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L scores 4.9 (Medium), and each metric is meaningful: the local attack vector and high complexity together require both that a vulnerable application accepts externally supplied ccs= values and passes them unsanitized to fopen(). The glibc advisory authors themselves explicitly state this usage pattern does not appear in common GNU/Linux distribution software. No CISA KEV entry exists, confirming no known active exploitation. No EPSS data was provided, so exploitation probability cannot be quantified from this data set. The C/I/A impact is rated Low across all three dimensions by the vendor, meaning even a successful exploit yields limited process-level damage rather than full system compromise. Impact is further bounded by the S:U (scope unchanged) metric, containing the effect to the faulting process. The primary risk is a narrow class of custom or third-party applications that forward untrusted user input into the fopen mode string's ccs= field without validation.

An attacker targets a local service or setuid application that accepts a user-supplied file-mode or encoding parameter and passes it directly to fopen() as part of the mode string without sanitizing the ,ccs= label. By supplying a mode string such as 'r,ccs=' (with an empty label after the equals sign), the attacker triggers a heap buffer overflow within glibc's fopen mode-string parser. Depending on heap layout, this could result in limited memory corruption within the calling process, potentially affecting confidentiality, integrity, or availability at the Low level assessed by the vendor. No public exploit code has been identified at time of analysis.