CVE-2026-5928
published 2026-04-20CVE-2026-5928: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
30.5th percentile
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | <= 2.43 | — |
| gnu | glibc | — | — |
| the_gnu_c_library | glibc | 2.1.1-89 – 2.43 | — |
| ubuntu | glibc | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.5HIGH
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU C Library up to 2.43 Unicode Character libio/wgenops.c _IO_wdefault_pbackfail buffer under-read (Nessus ID 308161 / WID-SEC-2026-1190)
vuldb·2026-04-21
CVE-2026-5928 [LOW] GNU C Library up to 2.43 Unicode Character libio/wgenops.c _IO_wdefault_pbackfail buffer under-read (Nessus ID 308161 / WID-SEC-2026-1190)
A vulnerability marked as problematic has been reported in GNU C Library up to 2.43. Affected by this vulnerability is the function _IO_wdefault_pbackfail of the file libio/wgenops.c of the component Unicode Character Handler. This manipulation causes buffer under-read.
The identification of this vulnerability is CVE-2026-5928. The attack can only be executed locally. There is no exploit available.
GHSA
GHSA-829p-mc9m-7xhr: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte
ghsa_unreviewed·2026-04-20
CVE-2026-5928 [HIGH] CWE-127 GHSA-829p-mc9m-7xhr: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-07-27·CVSS 7.5
CVE-2026-5450 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that the GNU C Library iconv function incorrectly handled
certain IBM character sets. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-4046)
It was discovered that the GNU C Library DNS functions incorrectly handled
certain DNS server responses when using gethostbyaddr or gethostbyaddr_r.
An attacker in a privileged network position could possibly use this issue
to cause an application to violate DNS specification or obtain incorrect
hostname information. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-4437, CVE-2026-4438)
It was discovered that the GNU C Library deprecated debugging functions
incorrectly enforced caller-supplied buf
Red Hat
glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
vendor_redhat·2026-04-20·CVSS 5.0
CVE-2026-5928 [MEDIUM] CWE-125 glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
A flaw was found in glibc (GNU C Library). When the `ungetwc` function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensitive information from memory or cause the program to crash, resulting in a denial of service.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: glibc (Red Hat Enterprise Linu
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-49363 artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
bugzilla·2026-06-25·CVSS 9.8
CVE-2026-49363 [CRITICAL] CVE-2026-49363 artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
CVE-2026-49363 artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
Pre-auth topology disclosure via Artemis CORE SUBSCRIBE_TOPOLOGY_V2 on channel0. CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscriptions with zero authentication -- no getSecurityStore(), no subject validation. Contrasts with federation handler fixed via ARTEMIS-5928 (CVE-2026-27446).
Vulnerable class: org.apache.activemq.artemis.core.protocol.core.impl.CoreProtocolManager
- https://github.com/apache/activemq-artemis/blob/2.16.0/artemis-server/src/main/java/org/apache/activemq/artemis/core/protocol/core/impl/CoreProtocolManager.java
- https://github.com/apache/activemq-artemis/blob/2.52.0/artemis-server/src/main/java/org/apache/activemq/ar
Bugzilla
CVE-2026-5928 glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
bugzilla·2026-04-20
CVE-2026-5928 [MEDIUM] CVE-2026-5928 glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
CVE-2026-5928 glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may ha
2026-04-20
Published