The vulnerability in glibc's ungetwc function involves a buffer under-read triggered by calling ungetwc on a FILE stream with wide characters encoded in overlapping single-byte and multi-byte character sets. Due to a bug in the _IO_wdefault_pbackfail function, ungetwc incorrectly operates on the regular character buffer pointer (fp->_IO_read_ptr) instead of the wide-stream read pointer (fp->_wide_data->_IO_read_ptr). This can cause reads before the allocated buffer, potentially disclosing neighboring heap data or causing a program crash if the pointer is NULL. The vulnerability affects glibc versions 2.43 and earlier and requires a special encoding scenario not present in standard Unicode sets.

The vulnerability can lead to a program crash (denial of service) or unintentional disclosure of adjacent heap memory contents. There is no indication of confidentiality or integrity impact beyond potential data disclosure from neighboring heap memory. The CVSS score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is unspecified, users should monitor the GNU C Library project for updates. Avoid using ungetwc with character encodings that have overlapping single-byte and multi-byte representations if possible until a fix is available.