CVE-2026-5450: CWE-122 Heap-based buffer overflow in The GNU C Library glibc
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
AI Analysis
Technical Summary
CVE-2026-5450 is a heap-based buffer overflow vulnerability in glibc versions 2.7 to 2.43. It occurs when the scanf family of functions is called with the %mc format specifier combined with an explicit width specifier greater than 1024. This leads to a one-byte overflow on the heap, potentially allowing an attacker to corrupt memory and cause arbitrary code execution or denial of service.
Potential Impact
Successful exploitation can lead to high impact including complete confidentiality, integrity, and availability compromise of the affected system due to heap memory corruption. The vulnerability is remotely exploitable without privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the GNU C Library vendor advisories for updates and apply patches once available.
CVE-2026-5450: CWE-122 Heap-based buffer overflow in The GNU C Library glibc
Description
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-5450 is a heap-based buffer overflow vulnerability in glibc versions 2.7 to 2.43. It occurs when the scanf family of functions is called with the %mc format specifier combined with an explicit width specifier greater than 1024. This leads to a one-byte overflow on the heap, potentially allowing an attacker to corrupt memory and cause arbitrary code execution or denial of service.
Potential Impact
Successful exploitation can lead to high impact including complete confidentiality, integrity, and availability compromise of the affected system due to heap memory corruption. The vulnerability is remotely exploitable without privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the GNU C Library vendor advisories for updates and apply patches once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- glibc
- Date Reserved
- 2026-04-02T21:47:21.403Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e6941f19fe3cd2cd32c4a0
Added to database: 04/20/2026, 21:01:19 UTC
Last enriched: 07/15/2026, 11:24:38 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 734
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.