CVE-2026-19542
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In the GNU C Library versions 2.1 to 2.44, calling tdelete on a sufficiently deep tree may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree; two rebalancing branches push an additional entry without checking the capacity.
Risk Assessment
This may cause an application crash when using tsearch and tdelete. Triggering requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), implying a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions.
Recommendation
Upgrade glibc to a version containing the fix. No affected application in common distributions has been identified, but monitor official updates.
Other vulnerabilities in GNU C Library
See all- CVE-2026-0861High
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 to 2.42 may result in an integer overflow, which could consequently result in heap corruption. To exploit this, an attacker must control both the size and alignment arguments; the size must be close to PTRDIFF_MAX and the alignment in the range [1<<62+1, 1<<63] (exactly 1<<63 for posix_memalign and aligned_alloc). In practice, alignment is typically not attacker-controlled, making exploitation unlikely.
- CVE-2024-2961High
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.
- CVE-2025-0395Medium
In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.
- CVE-2025-4802Medium
In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).
- CVE-2026-5450Critical
Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.
- CVE-2023-4911HighActively exploited
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- CVE-2020-6096High
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() with a negative value for the 'num' parameter results in a signed comparison vulnerability, potentially leading to out-of-bounds memory writes and remote code execution.
- CVE-2018-19591High
In the GNU C Library (glibc) through version 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
- CVE-2026-84243High
A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.
- CVE-2026-97399Low
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This occurs when attacker-controlled input strings match up to the edge of their page and the neighboring page is either not mapped or not readable.
Original NVD description (English source)
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS