CVE-2026-5450

The bug (CWE-122, CWE-787) manifests when using the %mc format specifier (malloc'd character match) in combination with a field width (width specifier) value greater than 1024. In such a situation, the scanf family function incorrectly calculates the size of the allocated heap buffer, resulting in writing one byte beyond its boundary (off-by-one heap buffer overflow). Incorrect write to the heap can lead to corruption of memory management structures.

An attacker can cause arbitrary code execution (RCE), violation of data confidentiality and integrity, or service unavailability. Network vector without authentication requirements and user interaction (AV:N/AC:L/PR:N/UI:N) significantly increases the risk of exploitation.

Update glibc to a version that does not contain the vulnerability according to information published by the vendor (announcement available at the address indicated in the references). Until the update is applied, it is recommended to avoid processing untrusted input data through scanf family functions using the %mc specifier with field width exceeding 1024.

GNU C Library (glibc) in versions from 2.7 to 2.43 inclusive — affects Linux systems and other environments using glibc within this version range.