# CVE-2026-5450: GNU glibc heap buffer overflow in scanf %mc specifier

Source: https://junglewise.ai/threats/cve-2026-5450-gnu-glibc-heap-buffer-overflow-in-scanf-mc-specifier  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-5450 · Severity: critical · CVSS 9.8 · Published 2026-04-20

A vulnerability exists in the GNU C Library (glibc), a fundamental software component used by almost all Linux-based systems and many embedded devices. When an application processes specially formatted input using certain text-scanning functions, it may trigger a memory error. This could allow an attacker to crash the application or potentially take control of the system, though the specific coding pattern required is not commonly used in most standard software.

Technologies: [Gnu Glibc](https://junglewise.ai/threats/technologies/glibc), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp), [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-5450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5450 being exploited in the wild.

**How severe is CVE-2026-5450?** Critical severity, with a CVSS score of 9.8, published 20 April 2026.

**Which products and versions are affected?** Gnu Glibc 2.7 to 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5.

**Is there a fix for CVE-2026-5450?** A patch was published on 2026-05-08: Fix committed to glibc master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5450 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5450?** Check whether you run Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A one-byte heap buffer overflow exists in glibc's __vfscanf_internal function due to an incorrect buffer growth formula. When the scanf family of functions is called with the %mc (malloc'd character match) or %mC specifier and an explicit format width greater than 1024, the realloc expansion under-allocates by one byte. An attacker providing controlled input to an application using this specific format specifier can trigger a single-byte overwrite past the end of the heap buffer, potentially leading to arbitrary code execution. The vulnerability affects glibc versions 2.7 through 2.43 and has been addressed in version 2.44.

## Affected products

- GNU glibc 2.7 to 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5

## Timeline

- 2026-03-19: disclosed: Reported by Rocket Ma
- 2026-04-20: advisory: Initial NVD publication and glibc security advisory GLIBC-SA-2026-0009
- 2026-05-08: patched: Fix committed to glibc master branch

## References

- [https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/](https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/)
- [https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450](https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)

## Related threats

- [Linux Kernel denial of service in IPv6 tunneled traffic handling](https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling)
- [Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg)
- [Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node)
- [Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption)
- [Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe)