Quick answers
- Is CVE-2026-19542 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19542 being exploited in the wild.
- How severe is CVE-2026-19542?
- Medium severity, with a CVSS score of 5.6, published 14 September 2026.
- Which products and versions are affected?
- Gnu C Library 2.1 to 2.44.
- Is there a fix for CVE-2026-19542?
- A patch was published on 2026-08-14: glibc 2.45 (commit e2789c46e3bfdcd67a82bea9946b315c179e83d3) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19542 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19542?
- Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stack-based buffer overflow in the tdelete function's tree rebalancing logic. The tdelete implementation maintains an explicit stack (via alloca) of parent nodes for rebalancing; during tree descent, two specific rebalancing branches push entries without checking array capacity, causing an out-of-bounds write when the stack is exactly full. Exploitation requires a tree at exactly depth 40 (or multiples of 20 beyond that), implying at least one million nodes. The attack vector is network-adjacent (requires an attacker to drive large numbers of insertions/deletions through an application), though the overflow value itself (a tree node pointer) is not directly attacker-controlled. The vulnerability affects glibc 2.1–2.44; a fix was released in glibc 2.45 and backported to earlier stable branches, replacing alloca with a static maximum-sized allocation.
Affected products
- GNU C Library 2.1 to 2.44
Timeline
- 2026-08-11: disclosed
- 2026-08-14: patched: glibc 2.45 (commit e2789c46e3bfdcd67a82bea9946b315c179e83d3)