The vulnerability identified as CVE-2026-5450 is a heap buffer overflow in the glibc scanf function when used with the %mc format specifier and a large width value. This flaw can lead to memory corruption. It affects multiple Red Hat Enterprise Linux versions and related products, including RHEL 8, 9.2, and 10, as well as Red Hat OpenShift and CodeReady Linux Builder variants. Red Hat has issued security advisories RHSA-2026:33231 and RHSA-2026:33092 detailing the issue and providing patches. The advisories include updated glibc packages that fix the vulnerability. The vulnerability is rated as moderate severity by Red Hat. No known exploits in the wild have been reported. The issue is addressed by applying the official patches provided by Red Hat.

The heap buffer overflow in glibc's scanf function could lead to memory corruption, which may cause application crashes or potentially allow an attacker to execute arbitrary code if exploited. However, Red Hat rates the security impact as moderate, indicating the risk is not critical but still significant enough to warrant prompt patching. No known active exploitation has been reported. The vulnerability affects core system libraries, so it could impact many programs relying on glibc for input parsing.

Red Hat has released official patches for this vulnerability in updated glibc packages for affected versions of Red Hat Enterprise Linux 8, 9.2, and 10, as well as related products. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official fixes. The vulnerability is resolved by installing the updated glibc packages provided in the advisories RHSA-2026:33231 and RHSA-2026:33092.