CVE-2026-5928
published 2026-04-20CVE-2026-5928: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
29.3th percentile
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | <= 2.43 | — |
| gnu | glibc | — | — |
| the_gnu_c_library | glibc | 2.1.1-89 – 2.43 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GNU C Library up to 2.43 Unicode Character libio/wgenops.c _IO_wdefault_pbackfail buffer under-read (Nessus ID 308161 / WID-SEC-2026-1190)
vuldb·2026-04-21
CVE-2026-5928 [LOW] GNU C Library up to 2.43 Unicode Character libio/wgenops.c _IO_wdefault_pbackfail buffer under-read (Nessus ID 308161 / WID-SEC-2026-1190)
A vulnerability marked as problematic has been reported in GNU C Library up to 2.43. Affected by this vulnerability is the function _IO_wdefault_pbackfail of the file libio/wgenops.c of the component Unicode Character Handler. This manipulation causes buffer under-read.
The identification of this vulnerability is CVE-2026-5928. The attack can only be executed locally. There is no exploit available.
GHSA
GHSA-829p-mc9m-7xhr: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte
ghsa_unreviewed·2026-04-20
CVE-2026-5928 [HIGH] CWE-127 GHSA-829p-mc9m-7xhr: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.
A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation
Red Hat
glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
vendor_redhat·2026-04-20·CVSS 5.0
CVE-2026-5928 [MEDIUM] CWE-125 glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings
A flaw was found in glibc (GNU C Library). When the `ungetwc` function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensitive information from memory or cause the program to crash, resulting in a denial of service.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: glibc (Red Hat Enterprise Linu
No detection rules found.
No public exploits indexed.
2026-04-20
Published