CVE-2026-18374: Buffer overflow in fopen mode argument processing in The GNU C Library glibc

The vulnerability arises from improper processing of the mode argument in the fopen function of glibc versions 2.45 and earlier. Specifically, passing an effectively empty string to the ,ccs= syntax extension in the mode argument can trigger a heap buffer overflow if the mode string is attacker controlled. This flaw is identified as CWE-787 (Out-of-bounds Write). There is no indication of known exploits in the wild, and the vulnerability requires local attack vector with high attack complexity and no privileges or user interaction. The CVSS 3.1 base score is 4.9 (medium severity).

Successful exploitation could lead to a heap buffer overflow, potentially causing limited confidentiality, integrity, and availability impacts. However, the attack complexity is high, and the vulnerability requires local access. The impact is limited to scenarios where attacker-controlled input is passed to fopen with the ,ccs= mode syntax, which is not common in typical GNU/Linux applications.

No official patch or remediation level has been published yet. Users and developers should avoid passing unvalidated user-supplied values to the ,ccs= syntax extension in fopen mode arguments. Monitor the GNU C Library vendor advisories for updates and apply patches once available.