CVE Feed

    Dashboard / CVE / CVE-2026-18374

    CVE-2026-18374

    Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

    Published:Aug 27, 2026
    Last Modified:Aug 28, 2026
    EPS:Aug 27, 2026
    EPSS Score:0.0015
    CVSS Score:4.9

    Affected Products

    Vendor
    The Gnu C Library
    Product
    Glibc

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2026-89092 (CVSS 4.2) — The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS se…
    CVE-2026-6791 (CVSS 6.6) — When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function ext…
    CVE-2026-6238 (CVSS 6.5) — The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2…
    CVE-2026-5435 (CVSS 7.3) — The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail…
    CVE-2026-5450 (CVSS 9.8) — Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 t…
    CVE-2026-5928 (CVSS 7.5) — Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlap…
    CVE-2026-5358 (CVSS 8.2) — REJECTED: CVE-2026-5358 is rejected for two reasons. Firstly it has been discovered that no NIS+ client or ser…
    CVE-2026-4046 (CVSS 7.5) — The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when…
    CVE-2026-4438 (CVSS 5.4) — Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS back…
    CVE-2026-4437 (CVSS 7.5) — Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS back…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High