CVE-2026-5928
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the GNU C Library version 2.43 and earlier, calling ungetwc on a FILE stream with wide characters encoded in a character set that has overlaps between single-byte and multi-byte encodings may cause an out-of-bounds read before an allocated buffer. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail) causes ungetwc to operate on the regular character buffer instead of the wide-stream read pointer, potentially leading to disclosure of heap data or a program crash.
Risk Assessment
The organization risks unintentional disclosure of sensitive heap data or system crashes if applications use ungetwc on streams with certain character encodings (e.g., Shift-JIS).
Recommendation
Upgrade GNU C Library to version 2.44 or later, which includes the fix. If upgrading is not possible, avoid using ungetwc with character sets that have overlapping single-byte and multi-byte representations.
Other vulnerabilities in GNU C Library
See all- CVE-2024-2961High
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.
- CVE-2023-4911High
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- CVE-2025-0395Medium
In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.
- CVE-2025-4802Medium
In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).
- CVE-2026-5450Critical
Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.
- CVE-2026-18374Medium
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
- CVE-2026-6368Low
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
- CVE-2026-6238Medium
In the GNU C Library (glibc) versions 2.0.1 through 2.43, a vulnerability exists in the deprecated functions ns_printrrf, ns_printrr, and fp_nquery. These functions fail to validate RDATA content against RDATA length in DNS responses for A6, CERT, LOC, TKEY, or TSIG records, potentially allowing an attacker to craft a DNS response causing application crash or uninitialized memory read.
- CVE-2026-5435High
In the GNU C Library (glibc) version 2.2 and later, the deprecated functions ns_printrrf, ns_printrr, and fp_nquery fail to enforce the caller-supplied buffer length, which can lead to an out-of-bounds write when printing TSIG records.
- CVE-2026-4046High
The iconv() function in GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from IBM1390 or IBM1399 character sets. This vulnerability can be exploited remotely to crash an application.
Original NVD description (English source)
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.