GNU C Library (glibc) CVE-2026-5928

Application must explicitly call ungetwc() to push wide characters back onto a FILE stream opened in wide character mode (fwide() or wide-oriented functions like fgetwc()). The input character encoding must have overlaps between single-byte and multi-byte character representations-this excludes all standard Unicode encodings (UTF-8, UTF-16, UTF-32) where the bug cannot trigger per the description. Vulnerable encodings include certain legacy East Asian character sets like Shift-JIS, EUC-JP, EUC-KR, or EUC-CN where byte sequence ambiguity exists. For the NULL pointer crash scenario, the fp->_IO_read_ptr must be uninitialized, which occurs in specific stream initialization states. For information disclosure, heap memory layout must position sensitive data adjacent to the misused buffer region. These combined prerequisites significantly limit real-world exploitability-most modern applications use UTF-8 exclusively and many do not use wide character pushback operations. Applications processing user-supplied data in legacy encodings with wide stream APIs represent the highest-risk subset.

Real-world risk is significantly lower than the CVSS 7.5 score suggests due to multiple limiting factors. While CVSS indicates AV:N/AC:L/PR:N suggesting easy remote exploitation, the technical reality requires highly specific preconditions: applications must explicitly use ungetwc() for wide character pushback operations with non-Unicode character encodings having single-byte/multi-byte overlaps. The EPSS score of 0.02% (5th percentile) reflects security researchers' assessment that exploitation probability is extremely low despite theoretical network accessibility. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in real-world environments. The primary impact per CVSS is availability (A:H) with no confidentiality or integrity impact, though the description mentions potential heap data disclosure in specialized scenarios-this discrepancy suggests CVSS may underweight the information disclosure risk. The SSVC framework would likely classify this as 'defer' priority: technical impact is partial (DoS), exploitation is not automatable (requires specific encoding conditions), and no evidence of active exploitation exists. Most modern applications use UTF-8 or other Unicode encodings where this bug cannot trigger. Priority should focus on systems using legacy character encodings (certain East Asian encodings like Shift-JIS, EUC variants) with wide character stream operations.

An attacker develops a network service client that sends specially crafted input to a server application using glibc for wide character stream processing with a legacy character encoding like Shift-JIS or EUC-JP. The malicious input triggers calls to ungetwc() during stream parsing, causing the buggy _IO_wdefault_pbackfail function to manipulate incorrect buffer pointers. If fp->_IO_read_ptr is uninitialized (NULL), the application crashes with a segmentation fault, enabling a denial-of-service attack against the server. In cases where the pointer is initialized but points to heap memory, the under-read may expose adjacent heap data structures, potentially leaking sensitive information like cryptographic keys, session tokens, or user data stored nearby in memory. The attack complexity is low from a network perspective (AV:N/AC:L) but requires the target application to use specific glibc stream functions with vulnerable character encodings.