CVE-2026-5928: CWE-127 Buffer under-read in The GNU C Library glibc
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
AI Analysis
Technical Summary
CVE-2026-5928 is a buffer under-read vulnerability (CWE-127) in glibc versions 2.1.1 to 2.89. It occurs when ungetwc is called on a FILE stream containing wide characters encoded in character sets with overlapping single-byte and multi-byte encodings. The bug in _IO_wdefault_pbackfail causes ungetwc to use the regular character buffer pointer (fp->_IO_read_ptr) instead of the wide-stream read pointer (fp->_wide_data->_IO_read_ptr), potentially reading memory before the allocated buffer. This can lead to unintentional disclosure of neighboring heap data or a program crash, especially if fp->_IO_read_ptr is uninitialized (NULL). The vulnerability requires a special encoding scenario and does not affect standard Unicode encodings.
Potential Impact
The vulnerability can cause a program crash (availability impact) or unintentional disclosure of adjacent heap memory (confidentiality impact) when processing wide characters with specific overlapping encodings. There is no indication of integrity impact. The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor the GNU C Library advisories for updates and apply patches once available. Until then, avoid processing wide characters with overlapping single-byte and multi-byte encodings using ungetwc if possible.
CVE-2026-5928: CWE-127 Buffer under-read in The GNU C Library glibc
Description
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-5928 is a buffer under-read vulnerability (CWE-127) in glibc versions 2.1.1 to 2.89. It occurs when ungetwc is called on a FILE stream containing wide characters encoded in character sets with overlapping single-byte and multi-byte encodings. The bug in _IO_wdefault_pbackfail causes ungetwc to use the regular character buffer pointer (fp->_IO_read_ptr) instead of the wide-stream read pointer (fp->_wide_data->_IO_read_ptr), potentially reading memory before the allocated buffer. This can lead to unintentional disclosure of neighboring heap data or a program crash, especially if fp->_IO_read_ptr is uninitialized (NULL). The vulnerability requires a special encoding scenario and does not affect standard Unicode encodings.
Potential Impact
The vulnerability can cause a program crash (availability impact) or unintentional disclosure of adjacent heap memory (confidentiality impact) when processing wide characters with specific overlapping encodings. There is no indication of integrity impact. The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor the GNU C Library advisories for updates and apply patches once available. Until then, avoid processing wide characters with overlapping single-byte and multi-byte encodings using ungetwc if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- glibc
- Date Reserved
- 2026-04-08T22:47:29.814Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e6942119fe3cd2cd32c4c8
Added to database: 04/20/2026, 21:01:21 UTC
Last enriched: 07/15/2026, 11:24:47 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 502
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.