CVE-2026-5450
published 2026-04-20CVE-2026-5450: Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with…
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.50%
42.7th percentile
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| gnu | glibc | 2.7 – 2.43 | — |
| the_gnu_c_library | glibc | >= 2.7 < * | * |
| ubuntu | glibc | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu7.5HIGH
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU C Library up to 2.43 malloc Character Match heap-based overflow (Nessus ID 308167 / WID-SEC-2026-1190)
vuldb·2026-04-21
CVE-2026-5450 [CRITICAL] GNU C Library up to 2.43 malloc Character Match heap-based overflow (Nessus ID 308167 / WID-SEC-2026-1190)
A vulnerability described as critical has been identified in GNU C Library up to 2.43. Affected by this issue is some unknown functionality of the component malloc Character Match Handler. Such manipulation leads to heap-based buffer overflow.
This vulnerability is referenced as CVE-2026-5450. The attack can only be performed from a local environment. No exploit is available.
GHSA
GHSA-v898-xg3c-w4rj: Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2
ghsa_unreviewed·2026-04-20
CVE-2026-5450 [CRITICAL] CWE-122 GHSA-v898-xg3c-w4rj: Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-07-27·CVSS 7.5
CVE-2026-5450 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that the GNU C Library iconv function incorrectly handled
certain IBM character sets. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-4046)
It was discovered that the GNU C Library DNS functions incorrectly handled
certain DNS server responses when using gethostbyaddr or gethostbyaddr_r.
An attacker in a privileged network position could possibly use this issue
to cause an application to violate DNS specification or obtain incorrect
hostname information. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-4437, CVE-2026-4438)
It was discovered that the GNU C Library deprecated debugging functions
incorrectly enforced caller-supplied buf
Red Hat
glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
vendor_redhat·2026-04-20·CVSS 5.0
CVE-2026-5450 [MEDIUM] CWE-131 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
A flaw was found in glibc (GNU C Library). This vulnerability occurs when an application uses the `scanf` family of functions with a `%mc` format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination can lead to a one-byte heap buffer overflow, potentially allowing an attacker to corrupt memory.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: glibc (Red Hat Enterprise Linux 10) - Fix deferred
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-46080 kernel: ocfs2: split transactions in dio completion to avoid credit exhaustion
bugzilla·2026-05-27
CVE-2026-46080 CVE-2026-46080 kernel: ocfs2: split transactions in dio completion to avoid credit exhaustion
CVE-2026-46080 kernel: ocfs2: split transactions in dio completion to avoid credit exhaustion
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: split transactions in dio completion to avoid credit exhaustion
During ocfs2 dio operations, JBD2 may report warnings via following
call trace:
ocfs2_dio_end_io_write
ocfs2_mark_extent_written
ocfs2_change_extent_flag
ocfs2_split_extent
ocfs2_try_to_merge_extent
ocfs2_extend_rotate_transaction
ocfs2_extend_trans
jbd2__journal_restart
start_this_handle
output: JBD2: kworker/6:2 wants too many credits credits:5450 rsv_credits:0 max:5449
To prevent exceeding the credits limit, modify ocfs2_dio_end_io_write() to
handle extents in a batch of transaction.
Additionally, relocate ocfs2_del_inode_from_orphan(). The orphan inode
Bugzilla
CVE-2026-5450 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width [fedora-all]
bugzilla·2026-05-01·CVSS 9.8
CVE-2026-5450 [CRITICAL] CVE-2026-5450 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width [fedora-all]
CVE-2026-5450 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-5450 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
bugzilla·2026-04-20
CVE-2026-5450 [MEDIUM] CVE-2026-5450 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
CVE-2026-5450 glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
2026-04-20
Published