Executive brief
The GNU C Library's tdelete function (used for tree data structure operations) contains a stack buffer overflow vulnerability that can crash applications. While the vulnerability requires extremely specific conditions—a tree with at least a million nodes at particular depths—and the overflow is difficult to control, it poses a denial-of-service risk to any application using the tsearch/tdelete functions with large datasets. Red Hat and other Linux distributors have not identified actively exploited cases in common applications.
Technical details
The vulnerability is a stack-based buffer overflow in the tdelete function's tree rebalancing logic. The tdelete implementation maintains an explicit stack (via alloca) of parent nodes for rebalancing; during tree descent, two specific rebalancing branches push entries without checking array capacity, causing an out-of-bounds write when the stack is exactly full. Exploitation requires a tree at exactly depth 40 (or multiples of 20 beyond that), implying at least one million nodes. The attack vector is network-adjacent (requires an attacker to drive large numbers of insertions/deletions through an application), though the overflow value itself (a tree node pointer) is not directly attacker-controlled. The vulnerability affects glibc 2.1–2.44; a fix was released in glibc 2.45 and backported to earlier stable branches, replacing alloca with a static maximum-sized allocation.
Affected products
- GNU C Library 2.1 to 2.44
Timeline
- 2026-08-11: disclosed
- 2026-08-14: patched: glibc 2.45 (commit e2789c46e3bfdcd67a82bea9946b315c179e83d3)