# CVE-2026-5435: GNU glibc out-of-bounds write in ns_printrrf TSIG handling

Source: https://junglewise.ai/threats/cve-2026-5435-gnu-glibc-out-of-bounds-write-in-ns-printrrf-tsig-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-5435 · Severity: high · CVSS 7.3 · Published 2026-04-28

The GNU C Library (glibc), a fundamental software component used by many Linux-based systems and industrial controllers, contains a flaw in how it handles certain network diagnostic functions. If an application uses these specific functions to process or print specially crafted network data, it could lead to a system crash or memory corruption. This could potentially allow an attacker to disrupt operations or gain unauthorized access to data on affected devices, such as Siemens industrial controllers.

Technologies: [Gnu Glibc](https://junglewise.ai/threats/technologies/glibc), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp), [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-5435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5435 being exploited in the wild.

**How severe is CVE-2026-5435?** High severity, with a CVSS score of 7.3, published 28 April 2026.

**Which products and versions are affected?** Gnu Glibc 2.2 through 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5.

**Is there a fix for CVE-2026-5435?** A patch was published on 2026-06-19: Fix committed to glibc master branch for version 2.44 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5435 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5435?** Check whether you run Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the deprecated glibc functions ns_printrrf, ns_printrr, and fp_nquery. The root cause is a failure to enforce caller-supplied buffer lengths during the processing of TSIG (Transaction Signature) records, specifically within the ns_sprintrrf function which uses a bare sprintf call without bounds checking. While these functions are not part of the default DNS resolver hot path, they are reachable via public libresolv packet-printing APIs. An attacker who can influence the DNS messages processed by an application using these diagnostic interfaces could trigger a buffer overflow of up to 6 bytes. The issue is fixed in glibc version 2.44 and backported to 2.43.

## Affected products

- GNU glibc 2.2 through 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5

## Timeline

- 2026-04-02: disclosed: Initial report by researcher 'shinobu'
- 2026-04-28: advisory: GLIBC-SA-2026-0011 published
- 2026-06-19: patched: Fix committed to glibc master branch for version 2.44
- 2026-07-01: patched: Fix backported to glibc 2.43 release branch

## References

- [https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/](https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/)
- [https://sourceware.org/bugzilla/show_bug.cgi?id=34033](https://sourceware.org/bugzilla/show_bug.cgi?id=34033)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)

## Related threats

- [Linux Kernel denial of service in IPv6 tunneled traffic handling](https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling)
- [Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg)
- [Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node)
- [Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption)
- [Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe)