Skip to main content

GNU C Library (glibc) CVE-2026-5450

| EUVDEUVD-2026-23978 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-04-20 glibc GHSA-v898-xg3c-w4rj
Critical
Disputed · 9.8 Vendor: glibc
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (glibc) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
CRITICAL
qualitative
Red Hat
5.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: glibc

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Patch released
Apr 29, 2026 - 02:30 nvd
Patch available
Re-analysis Queued
Apr 23, 2026 - 15:43 vuln.today
cvss_changed
Analysis Generated
Apr 21, 2026 - 20:24 vuln.today
CVSS changed
Apr 21, 2026 - 20:22 NVD
9.8 (CRITICAL)
EUVD ID Assigned
Apr 20, 2026 - 21:15 euvd
EUVD-2026-23978
Analysis Generated
Apr 20, 2026 - 21:15 vuln.today
CVE Published
Apr 20, 2026 - 20:55 nvd
CRITICAL 9.8

DescriptionCVE.org

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

AnalysisAI

Heap buffer overflow in glibc scanf functions versions 2.7 through 2.43 allows remote unauthenticated attackers to execute arbitrary code by providing malicious input to applications using %mc format specifiers with width >1024. CVSS 9.8 indicates critical network-accessible impact, but EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation activity at time of analysis. No CISA KEV listing confirms this as a theoretical risk requiring specific application usage patterns rather than widespread active exploitation. Successful exploitation depends on target applications parsing attacker-controlled input through affected scanf family functions with specific format string configurations.

Technical ContextAI

The GNU C Library (glibc) is the foundational C standard library for Linux and Unix-like systems, providing core runtime functions including formatted input parsing. The vulnerability resides in the scanf family of functions (scanf, fscanf, sscanf) when using the POSIX-extension %mc (malloc'd character match) format specifier combined with explicit width specifiers exceeding 1024 characters. The %mc allocator is designed to dynamically allocate memory for matched character sequences, but the implementation contains a CWE-122 heap-based buffer overflow that writes one byte beyond the allocated buffer boundary when width >1024. This affects all glibc versions from 2.7 (released 2007) through 2.43, encompassing nearly two decades of library releases and impacting virtually all Linux distributions and embedded systems using glibc. The heap corruption occurs during the parsing phase before application-level validation, making it a low-level memory safety issue in critical system infrastructure.

RemediationAI

Upgrade to glibc version 2.44 or later when released by the glibc project, monitoring the official sourceware.org announcement list at https://inbox.sourceware.org/libc-announce/. Vendor-specific patched versions not independently confirmed at time of analysis-consult distribution security advisories for backported fixes to stable branches (RHEL, Ubuntu LTS, Debian stable typically backport critical glibc patches within 48-72 hours). Immediate compensating controls: (1) Audit application code for scanf family function usage with %mc format specifier-replace with safer alternatives like getline() with explicit buffer management or POSIX getdelim(); (2) If scanf usage is unavoidable, enforce format string validation to reject width specifiers >1024 or hardcode format strings without runtime construction; (3) Deploy memory safety mitigations including ASLR, stack canaries, and heap protections (already default in most distributions but verify enabled); (4) Network segmentation to limit exposure of services processing untrusted input through vulnerable parsing functions. Note that disabling %m scanf extensions entirely via compiler flags may break legitimate application functionality-test thoroughly before production deployment. Code review focusing on network-facing input handlers provides highest risk reduction with lowest operational impact compared to emergency glibc upgrades.

More in Glibc

View all
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2015-7547 HIGH POC
8.1 Feb 18

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C

CVE-2023-6246 HIGH POC
8.4 Jan 31

Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r

CVE-2014-5119 HIGH POC
7.5 Aug 29

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe

CVE-2012-4412 HIGH POC
7.5 Oct 09

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende

CVE-2018-1000001 HIGH POC
7.8 Jan 31

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th

CVE-2023-25139 CRITICAL POC
9.8 Feb 03

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct

CVE-2021-33574 CRITICAL POC
9.8 May 25

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve

CVE-2019-1010022 CRITICAL POC
9.8 Jul 15

GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2019-9169 CRITICAL POC
9.8 Feb 26

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove

CVE-2017-1000366 HIGH POC
7.8 Jun 19

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

CVE-2014-9402 HIGH POC
7.8 Feb 24

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Se

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-5450 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy