CVE-2026-18374
published 2026-08-27CVE-2026-18374: Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier…
PriorityP425medium4.9CVSS 3.1
AVLACHPRNUINSUCLILAL
EPSS
0.14%
3.4th percentile
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| the_gnu_c_library | glibc | < 2.45 | 2.45 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when
ghsa_unreviewed·2026-08-27
CVE-2026-18374 [MEDIUM] CWE-787 Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Red Hat
glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string
vendor_redhat·2026-08-27·CVSS 4.9
CVE-2026-18374 [MEDIUM] CWE-134 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string
glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or l
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [epel-all]
bugzilla·2026-08-31·CVSS 4.9
CVE-2026-18374 [MEDIUM] CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [epel-all]
CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Bugzilla
CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [fedora-all]
bugzilla·2026-08-31·CVSS 4.9
CVE-2026-18374 [MEDIUM] CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [fedora-all]
CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Bugzilla
CVE-2026-18374 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string [fedora-all]
bugzilla·2026-08-31·CVSS 4.9
CVE-2026-18374 [MEDIUM] CVE-2026-18374 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string [fedora-all]
CVE-2026-18374 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Bugzilla
CVE-2026-18374 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string
bugzilla·2026-08-27·CVSS 4.9
CVE-2026-18374 [MEDIUM] CVE-2026-18374 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string
CVE-2026-18374 glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
2026-08-27
Published