Threats Tagged 'cve-2026-19542'

This security update for glibc addresses multiple vulnerabilities including invalid free, stack overflow, buffer overflows, out-of-bounds writes, assertion failures, and a race condition that could allow local privilege escalation. The update fixes issues in components such as wordexp, resolv_conf, fopen ccs extension, strfmon, tdelete, and character decoding routines. The vulnerabilities affect local and network contexts and can lead to process crashes or privilege escalation. The update is provided by SUSE and Red Hat for various glibc packages across architectures.

A buffer overflow vulnerability exists in GNU C Library (glibc) versions 2.38 to 2.44 when calling strfmon or strfmon_l with right-justified width padding. This can cause writes past the end of the caller-supplied output buffer. Exploitation requires specific application code paths and conditions. At the time of the advisory, no network-facing impact is known. Red Hat has issued a security update addressing this issue in their Hardened Images RPMs.

CVE-2026-18374 is a medium severity buffer overflow vulnerability in the GNU C Library (glibc) affecting version 2.45 and earlier. It occurs when an attacker-controlled mode string passed to the fopen function uses the ,ccs= syntax extension with an effectively empty string, potentially causing a heap buffer overflow. This usage pattern is uncommon in typical GNU/Linux applications, and applications should validate user-supplied ccs values before passing them to fopen.

A vulnerability in the GNU C Library (glibc) versions 2.1 through 2.44 allows a stack buffer overflow when calling tdelete on a sufficiently deep tree. This overflow occurs due to unchecked stack growth in the tdelete implementation, which may write one pointer past the end of an allocated array on the stack, potentially crashing the application. Exploitation requires a very large tree with at least a million nodes, making it difficult to trigger. No affected applications in common distributions have been identified. Red Hat has released security updates for their hardened images to address this issue.