CVE-2026-4437

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

In the GNU C Library (glibc) versions 2.0.1 through 2.43, a vulnerability exists in the deprecated functions ns_printrrf, ns_printrr, and fp_nquery. These functions fail to validate RDATA content against RDATA length in DNS responses for A6, CERT, LOC, TKEY, or TSIG records, potentially allowing an attacker to craft a DNS response causing application crash or uninitialized memory read.

In the GNU C Library (glibc) version 2.2 and later, the deprecated functions ns_printrrf, ns_printrr, and fp_nquery fail to enforce the caller-supplied buffer length, which can lead to an out-of-bounds write when printing TSIG records.

In the GNU C Library version 2.43 and earlier, calling ungetwc on a FILE stream with wide characters encoded in a character set that has overlaps between single-byte and multi-byte encodings may cause an out-of-bounds read before an allocated buffer. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail) causes ungetwc to operate on the regular character buffer instead of the wide-stream read pointer, potentially leading to disclosure of heap data or a program crash.