Executive brief
A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems and many embedded devices. When an application processes specially formatted input using certain text-scanning functions, it may trigger a memory error. This could allow an attacker to crash the application or potentially take control of the system, though the specific coding pattern required is not commonly used in most standard software.
Technical details
A one-byte heap buffer overflow exists in glibc's __vfscanf_internal function due to an incorrect buffer growth formula. When the scanf family of functions is called with the %mc (malloc'd character match) or %mC specifier and an explicit format width greater than 1024, the realloc expansion under-allocates by one byte. An attacker providing controlled input to an application using this specific format specifier can trigger a single-byte overwrite past the end of the heap buffer, potentially leading to arbitrary code execution. The vulnerability affects glibc versions 2.7 through 2.43 and has been addressed in version 2.44.
Affected products
- GNU glibc 2.7 to 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Timeline
- 2026-03-19: disclosed: Reported by Rocket Ma
- 2026-04-20: advisory: Initial NVD publication and glibc security advisory GLIBC-SA-2026-0009
- 2026-05-08: patched: Fix committed to glibc master branch