CVE-2026-19542
published 2026-09-14CVE-2026-19542: Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the…
PriorityP430medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
EPSS
0.23%
12.5th percentile
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.
The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| the_gnu_c_library | glibc | 2.1 – 2.44 | — |
| ubuntu | glibc | — | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_redhat4.2MEDIUM
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 2.1
CVE-2026-77117 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides
the corresponding fixes for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that GNU C Library had a buffer overflow in the strfmon
function when handling right-justification padding. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)
It was discovered that GNU C Library had an out-of-bounds stack array
access in the tdelete function. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2026-19542)
It was discovered that GNU C Library incorrectly
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-09-08·CVSS 2.1
CVE-2026-77117 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that GNU C Library had a buffer overflow in the strfmon
function when handling right-justification padding. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)
It was discovered that GNU C Library had an out-of-bounds stack array
access in the tdelete function. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2026-19542)
It was discovered that GNU C Library incorrectly handled memory when
calling wordexp with the WRDE_APPEND flag. An attacker could possibly use
this issue to cause a denial of service. (CVE-2026-63
Red Hat
glibc: Fix out-of-bounds array write in tdelete
vendor_redhat·2026-08-25·CVSS 4.2
CVE-2026-19542 [MEDIUM] CWE-787 glibc: Fix out-of-bounds array write in tdelete
glibc: Fix out-of-bounds array write in tdelete
A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information.
Statement: This Moderate impact vulnerability in glibc's `tdelete` function requires a local attacker with low privileges and user interaction to trigger an out-of-bounds write. While it could lead to denial of service or information disclosure, the high attack complexity limits its broader impact on Red Hat systems.
Mitigation: Mitigation for this issue is either not available or the currently available op
GHSA
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.
ghsa_unreviewed·2026-09-14
CVE-2026-19542 [MEDIUM] CWE-121 Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.
The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directl
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19542 zig: Fix out-of-bounds array write in tdelete [epel-all]
bugzilla·2026-08-25
CVE-2026-19542 [MEDIUM] CVE-2026-19542 zig: Fix out-of-bounds array write in tdelete [epel-all]
CVE-2026-19542 zig: Fix out-of-bounds array write in tdelete [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
misc: Fix out-of-bounds array write in tdelete (bug 34506)
Allocate the maximum array sizes directly, instead of resizing
the arrays as needed. This eliminates alloca usage from the
function, and fixes the out-of-bounds accesses. The asserts
guard against the bug coming back if the balancing of the tree
turns out not to work correctly.
Bugzilla
CVE-2026-19542 glibc: Fix out-of-bounds array write in tdelete [fedora-all]
bugzilla·2026-08-25
CVE-2026-19542 [MEDIUM] CVE-2026-19542 glibc: Fix out-of-bounds array write in tdelete [fedora-all]
CVE-2026-19542 glibc: Fix out-of-bounds array write in tdelete [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
misc: Fix out-of-bounds array write in tdelete (bug 34506)
Allocate the maximum array sizes directly, instead of resizing
the arrays as needed. This eliminates alloca usage from the
function, and fixes the out-of-bounds accesses. The asserts
guard against the bug coming back if the balancing of the tree
turns out not to work correctly.
Bugzilla
CVE-2026-19542 zig: Fix out-of-bounds array write in tdelete [fedora-all]
bugzilla·2026-08-25
CVE-2026-19542 [MEDIUM] CVE-2026-19542 zig: Fix out-of-bounds array write in tdelete [fedora-all]
CVE-2026-19542 zig: Fix out-of-bounds array write in tdelete [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
misc: Fix out-of-bounds array write in tdelete (bug 34506)
Allocate the maximum array sizes directly, instead of resizing
the arrays as needed. This eliminates alloca usage from the
function, and fixes the out-of-bounds accesses. The asserts
guard against the bug coming back if the balancing of the tree
turns out not to work correctly.
Bugzilla
CVE-2026-19542 glibc: Fix out-of-bounds array write in tdelete
bugzilla·2026-08-25
CVE-2026-19542 [MEDIUM] CVE-2026-19542 glibc: Fix out-of-bounds array write in tdelete
CVE-2026-19542 glibc: Fix out-of-bounds array write in tdelete
misc: Fix out-of-bounds array write in tdelete (bug 34506)
Allocate the maximum array sizes directly, instead of resizing
the arrays as needed. This eliminates alloca usage from the
function, and fixes the out-of-bounds accesses. The asserts
guard against the bug coming back if the balancing of the tree
turns out not to work correctly.
2026-09-14
Published