CVE-2026-5435: GNU glibc out-of-bounds write in ns_printrrf TSIG handling

CVE-2026-5435 · Severity: high · CVSS 7.3 · Published 2026-04-28

The GNU C Library (glibc), a fundamental software component used by many Linux-based systems and industrial controllers, contains a flaw in how it handles certain network diagnostic functions. If an application uses these specific functions to process or print specially crafted network data, it could lead to a system crash or memory corruption. This could potentially allow an attacker to disrupt operations or gain unauthorized access to data on affected devices, such as Siemens industrial controllers.

Technologies: Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Gnu, Siemens.

Quick answers

Is CVE-2026-5435 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5435 being exploited in the wild.
How severe is CVE-2026-5435?
High severity, with a CVSS score of 7.3, published 28 April 2026.
Which products and versions are affected?
Gnu Glibc 2.2 through 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5.
Is there a fix for CVE-2026-5435?
A patch was published on 2026-06-19: Fix committed to glibc master branch for version 2.44 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5435 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-5435?
Check whether you run Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the deprecated glibc functions ns_printrrf, ns_printrr, and fp_nquery. The root cause is a failure to enforce caller-supplied buffer lengths during the processing of TSIG (Transaction Signature) records, specifically within the ns_sprintrrf function which uses a bare sprintf call without bounds checking. While these functions are not part of the default DNS resolver hot path, they are reachable via public libresolv packet-printing APIs. An attacker who can influence the DNS messages processed by an application using these diagnostic interfaces could trigger a buffer overflow of up to 6 bytes. The issue is fixed in glibc version 2.44 and backported to 2.43.

Affected products

  • GNU glibc 2.2 through 2.43
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5

Timeline

  • 2026-04-02: disclosed: Initial report by researcher 'shinobu'
  • 2026-04-28: advisory: GLIBC-SA-2026-0011 published
  • 2026-06-19: patched: Fix committed to glibc master branch for version 2.44
  • 2026-07-01: patched: Fix backported to glibc 2.43 release branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.