This vulnerability in glibc affects the ungetwc function used for wide character streams. Due to a bug in the _IO_wdefault_pbackfail function, ungetwc incorrectly uses the regular character buffer pointer instead of the wide-stream read pointer, leading to a buffer under-read. This under-read can disclose adjacent heap memory or cause crashes when the read pointer is uninitialized. The flaw manifests only when the input character encoding has overlapping single-byte and multi-byte character representations, which is not the case for standard Unicode encodings. Affected versions include glibc 2.43 and earlier.

Exploitation of this vulnerability may lead to unintentional disclosure of neighboring heap data or cause a program crash. The impact depends on the character encoding used and the specific application context. There are no known exploits in the wild. The vulnerability does not affect standard Unicode character sets, limiting its practical impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor the GNU C Library project for updates addressing this issue. Until a fix is released, avoid using ungetwc with character encodings that have overlapping single-byte and multi-byte representations if possible.