Skip to main content

GNU C Library (glibc) CVE-2026-5928

| EUVDEUVD-2026-23980 HIGH
Buffer Under-read (CWE-127)
2026-04-20 glibc GHSA-829p-mc9m-7xhr
Denial Of Service Glibc
7.5
CVSS 3.1 · Vendor: glibc
Share

Severity by source

Vendor (glibc) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
5.0 MEDIUM
qualitative

Primary rating from Vendor (glibc).

CVSS VectorVendor: glibc

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Patch released
Apr 29, 2026 - 02:30 nvd
Patch available
Re-analysis Queued
Apr 23, 2026 - 15:43 vuln.today
cvss_changed
Analysis Generated
Apr 21, 2026 - 20:24 vuln.today
CVSS changed
Apr 21, 2026 - 20:22 NVD
7.5 (HIGH)
EUVD ID Assigned
Apr 20, 2026 - 21:15 euvd
EUVD-2026-23980
Analysis Generated
Apr 20, 2026 - 21:15 vuln.today
CVE Published
Apr 20, 2026 - 20:37 nvd
HIGH 7.5

DescriptionCVE.org

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.

AnalysisAI

Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability affects glibc's wide character stream handling in the standard I/O library (libio). The bug resides in _IO_wdefault_pbackfail within libio/wgenops.c, which implements the pushback mechanism for wide character streams (FILE streams opened in wide mode). When ungetwc() is called to push a wide character back onto the stream, the function erroneously manipulates fp->_IO_read_ptr (the narrow character buffer pointer) instead of fp->_wide_data->_IO_read_ptr (the wide character stream pointer). This causes buffer pointer arithmetic to operate on incorrect memory regions. The out-of-bounds read occurs because the function attempts to move the read pointer backward in memory without proper bounds checking against the actual allocated buffer. CWE-127 (Buffer Under-read) represents this class of memory safety issue where reads occur before the beginning of allocated memory regions. The vulnerability affects the core glibc library used by virtually all Linux-based systems and many Unix-like operating systems for fundamental C standard library operations.

RemediationAI

Upgrade to glibc version 2.44 or later when available, as the vulnerable code exists through version 2.43 according to EUVD data. Monitor the upstream glibc bug tracker at https://sourceware.org/bugzilla/show_bug.cgi?id=33998 for patch commits and release announcements. No vendor-released patched version confirmed at time of analysis-upstream fix development should be tracked through the referenced bugzilla entry. For systems that cannot immediately upgrade, implement these compensating controls with noted trade-offs: (1) Audit application code to identify use of ungetwc() on wide character streams and refactor to avoid pushback operations where possible-trade-off is development effort and potential logic changes; (2) Restrict applications to UTF-8 and standard Unicode encodings exclusively, disabling support for legacy character sets with single-byte/multi-byte overlaps (Shift-JIS, certain EUC variants)-trade-off is loss of legacy encoding support may break internationalization for older systems; (3) Deploy memory safety tools like AddressSanitizer in testing/staging environments to detect heap under-reads before production deployment-trade-off is performance overhead makes this unsuitable for production; (4) Enable kernel-level memory protection mechanisms (ASLR, heap hardening) to reduce information disclosure risk from heap reads-limited effectiveness as these don't prevent the crash condition.

More in Glibc

View all
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2015-7547 HIGH POC
8.1 Feb 18

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
CVE-2023-6246 HIGH POC
8.4 Jan 31

Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
CVE-2014-5119 HIGH POC
7.5 Aug 29

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
CVE-2012-4412 HIGH POC
7.5 Oct 09

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
CVE-2018-1000001 HIGH POC
7.8 Jan 31

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
CVE-2023-25139 CRITICAL POC
9.8 Feb 03

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct

CVE-2021-33574 CRITICAL POC
9.8 May 25

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
CVE-2019-1010022 CRITICAL POC
9.8 Jul 15

GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2019-9169 CRITICAL POC
9.8 Feb 26

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
CVE-2017-1000366 HIGH POC
7.8 Jun 19

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
CVE-2014-9402 HIGH POC
7.8 Feb 24

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Se

Same weakness CWE-127 – Buffer Under-read

View all
CVE-2020-5360 HIGH
7.5
CVE-2025-32050 MEDIUM
5.9
CVE-2026-45683 LOW
3.8
CVE-2024-10395 HIGH
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-5928 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy