Threats affecting pkg:rpm/gnu/glibc

CVE-2026-115819 is an off-by-one error in the GNU C Library (glibc) versions 2.2 through 2.44 affecting the wide scanf family of functions when used with %s or %[ conversions without the 'l' length modifier. This flaw causes an extra null byte to be written one byte past the end of the destination array if the converted multibyte string exactly fills the buffer. This can lead to adjacent memory corruption or process crashes. The vulnerability does not affect narrow scanf functions or wide scanf conversions into wchar_t arrays. The issue impacts all architectures and ABIs supported by glibc.

A vulnerability in GNU C Library versions 2.18 through 2.31 causes the iconv converter to hang when converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding. This results in the calling application becoming unresponsive.