CVE-2026-5928: GNU C Library glibc buffer under-read in ungetwc

CVE-2026-5928 · Severity: high · CVSS 7.5 · Published 2026-04-20

The GNU C Library (glibc), a fundamental component of Linux-based systems and embedded devices like Siemens industrial controllers, contains a flaw in how it handles specific character input. An attacker could potentially exploit this to cause a program to crash or to reveal small amounts of sensitive information from the system's memory. This affects the reliability of applications and could lead to service outages in industrial or enterprise environments.

Technologies: Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Gnu, Siemens.

Quick answers

Is CVE-2026-5928 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5928 being exploited in the wild.
How severe is CVE-2026-5928?
High severity, with a CVSS score of 7.5, published 20 April 2026.
Which products and versions are affected?
Gnu Glibc <= 2.43; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 < V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 < V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 < V3.1.6.
Is there a fix for CVE-2026-5928?
A patch was published on 2026-05-07: Fixed in glibc master branch for version 2.44 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5928 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-5928?
Check whether you run Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer under-read vulnerability exists in the GNU C Library (glibc) wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c). The ungetwc() function incorrectly operates on the regular character buffer (fp->_IO_read_ptr) instead of the wide-stream read pointer (fp->_wide_data->_IO_read_ptr). This logic error allows an attacker to trigger a buffer under-read when using specific character encodings where single-byte and multi-byte representations overlap, potentially leaking heap data. If the byte stream is uninitialized (pointing to NULL), the flaw results in a segmentation fault. The issue is fixed in glibc version 2.44 and has been backported to stable branches 2.41, 2.42, and 2.43.

Affected products

  • The GNU C Library glibc <= 2.43
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 < V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 < V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 < V3.1.6

Timeline

  • 2026-03-17: disclosed: Bug reported to Sourceware Bugzilla
  • 2026-04-20: advisory: Initial CVE publication
  • 2026-05-07: patched: Fixed in glibc master branch for version 2.44
  • 2026-05-09: patched: Patches backported to glibc 2.42 and 2.43 branches
  • 2026-07-14: advisory: Siemens updated advisory for SIMATIC S7-1500 CPUs

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.