Executive brief
The GNU C Library (glibc), a fundamental component of Linux-based systems and embedded devices like Siemens industrial controllers, contains a flaw in how it handles specific character input. An attacker could potentially exploit this to cause a program to crash or to reveal small amounts of sensitive information from the system's memory. This affects the reliability of applications and could lead to service outages in industrial or enterprise environments.
Technical details
A buffer under-read vulnerability exists in the GNU C Library (glibc) wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c). The ungetwc() function incorrectly operates on the regular character buffer (fp->_IO_read_ptr) instead of the wide-stream read pointer (fp->_wide_data->_IO_read_ptr). This logic error allows an attacker to trigger a buffer under-read when using specific character encodings where single-byte and multi-byte representations overlap, potentially leaking heap data. If the byte stream is uninitialized (pointing to NULL), the flaw results in a segmentation fault. The issue is fixed in glibc version 2.44 and has been backported to stable branches 2.41, 2.42, and 2.43.
Affected products
- The GNU C Library glibc <= 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 < V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 < V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 < V3.1.6
Timeline
- 2026-03-17: disclosed: Bug reported to Sourceware Bugzilla
- 2026-04-20: advisory: Initial CVE publication
- 2026-05-07: patched: Fixed in glibc master branch for version 2.44
- 2026-05-09: patched: Patches backported to glibc 2.42 and 2.43 branches
- 2026-07-14: advisory: Siemens updated advisory for SIMATIC S7-1500 CPUs