CVE-2026-0861
published 2026-01-14CVE-2026-0861: Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may…
PriorityP346high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.35%
27.6th percentile
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.
Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.42-8 (forky) | glibc 2.42-8 (forky) |
| gnu | glibc | >= 0 < 2.41-12+deb13u2 | 2.41-12+deb13u2 |
| gnu | glibc | >= 0 < 2.42-8 | 2.42-8 |
| gnu | glibc | >= 0 < 2.35-0ubuntu3.13 | 2.35-0ubuntu3.13 |
| gnu | glibc | >= 0 < 2.39-0ubuntu8.7 | 2.39-0ubuntu8.7 |
| gnu | glibc | >= 0 < 2.42-0ubuntu3.1 | 2.42-0ubuntu3.1 |
| gnu | glibc | >= 0 < 2.23-0ubuntu11.3+esm9 | 2.23-0ubuntu11.3+esm9 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1.6+esm6 | 2.27-3ubuntu1.6+esm6 |
| gnu | glibc | >= 0 < 2.31-0ubuntu9.18+esm1 | 2.31-0ubuntu9.18+esm1 |
| gnu | glibc | 2.30 – 2.42 | — |
| the_gnu_c_library | glibc | 2.30 – 2.42 | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.4HIGH
vendor_debian8.4HIGH
vendor_redhat8.4HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 7.5
CVE-2026-0861 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
Vitaly Simonovich discovered that the GNU C Library did not properly
initialize the input when WRDE_REUSE is used. An attacker could possibly
use this issue to cause applications to crash, leading to a denial of
service. (CVE-2025-15281)
Anastasia Belova discovered that the GNU C Library incorrectly handled
the regcomp function when memory allocation failures occured. An attacker
could possibly use this issue to cause applications to crash, leading to
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2025-8058)
Igor Morgenstern discovered that the GNU C Library incorrectly handled
the memalign fu
Red Hat
glibc: Integer overflow in memalign leads to heap corruption
vendor_redhat·2026-01-14·CVSS 8.4
CVE-2026-0861 [HIGH] CWE-190 glibc: Integer overflow in memalign leads to heap corruption
glibc: Integer overflow in memalign leads to heap corruption
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.
Typically the alignment argument passed to such functions is a known constrain
Debian
CVE-2026-0861: glibc - Passing too large an alignment to the memalign suite of functions (memalign, pos...
vendor_debian·2026·CVSS 8.4
CVE-2026-0861 [HIGH] CVE-2026-0861: glibc - Passing too large an alignment to the memalign suite of functions (memalign, pos...
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is
OSV
glibc vulnerabilities
osv·2026-02-03·CVSS 7.5
CVE-2025-15281 [HIGH] glibc vulnerabilities
glibc vulnerabilities
Vitaly Simonovich discovered that the GNU C Library did not properly
initialize the input when WRDE_REUSE is used. An attacker could possibly
use this issue to cause applications to crash, leading to a denial of
service. (CVE-2025-15281)
Anastasia Belova discovered that the GNU C Library incorrectly handled
the regcomp function when memory allocation failures occured. An attacker
could possibly use this issue to cause applications to crash, leading to
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2025-8058)
Igor Morgenstern discovered that the GNU C Library incorrectly handled
the memalign function when doing memory allocation. An attacker could
possibly use this issue
GHSA
GHSA-5pf6-63v3-88hw: Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library vers
ghsa_unreviewed·2026-01-14
CVE-2026-0861 [HIGH] CWE-190 GHSA-5pf6-63v3-88hw: Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library vers
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
OSV
CVE-2026-0861: Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2
osv·2026-01-14·CVSS 8.4
CVE-2026-0861 [HIGH] CVE-2026-0861: Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-0861 glibc: Integer overflow in memalign leads to heap corruption
bugzilla·2026-01-14·CVSS 8.4
CVE-2026-0861 [HIGH] CVE-2026-0861 glibc: Integer overflow in memalign leads to heap corruption
CVE-2026-0861 glibc: Integer overflow in memalign leads to heap corruption
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:1334 https://access.redhat.com/errata/RHSA-2026:1334
---
This comment was flagged as spam, view the edit history to see the original text if required.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:2786 https://access.redhat.com/errata/RHSA-2026:2786
Wiz
CVE-2026-0861 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-0861 [HIGH] CVE-2026-0861 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0861 :
NixOS vulnerability analysis and mitigation
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.
Typically the alignment argument passed to such functions is a known cons
2026-01-14
Published