Executive brief
The GNU C Library's fopen() function is used by nearly all C programs on Linux systems to open files. A flaw in how it processes the character set conversion (`ccs=`) mode parameter can cause a heap buffer overflow when an application passes an attacker-controlled empty string in that parameter. While this pattern is uncommon in standard Linux distributions, exploits could corrupt memory, leading to crashes, information disclosure, or potential code execution in applications that fail to validate this input.
Technical details
The vulnerability is a heap buffer overflow in the libio stdio implementation within glibc's fopen() function. The vulnerable code fails to properly validate the `ccs=` (character set conversion specification) parameter when it becomes empty after whitespace stripping. An attacker who controls the mode argument passed to fopen() can supply an empty ccs value (e.g., `"w,ccs= ,"`), causing the code to read and write past buffer boundaries. The attack requires local access and direct control over the fopen mode parameter; this is not typical in common Linux distributions. Patches were released in glibc 2.42, 2.43, 2.44, and 2.45, adding validation to reject empty charset specifications with EINVAL.
Affected products
- GNU C Library 2.45 and earlier
Timeline
- 2026-08-27: disclosed
- 2026-09-04: patched: Patches applied to glibc master and release branches 2.42–2.45