THE GNU C Library vulnerabilities
34 CVEs and advisories name THE GNU C Library as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-122054BIG-HKSCS decoding hang on crafted input
- CVE-2026-84243gettext: Directory traversal via the LANGUAGE environment variable
- CVE-2026-97399One-byte overread in strncasecmp on Power8
- CVE-2026-95818AT_SECURE program buffer overflow via $ORIGIN processing
- CVE-2026-86805AT_SECURE programs may load attacker-controlled code via $ORIGIN
- CVE-2026-8674Assertion failure in the DNS stub resolver with a long search domain
- CVE-2026-80489EUC_JISX0213 decoding may hang on crafted input
- CVE-2026-77117SHIFT_JISX0213 decoding may hang on crafted input
- CVE-2026-19542Stack-based out-of-bounds write in tdelete during tree rebalancing
- CVE-2026-19499Buffer overflow in strfmon and strfmon_l right-justification padding
- CVE-2026-89092Stack overflow in nscd due to unbounded alloca use
- CVE-2026-18374Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library versio
- CVE-2026-6791Potential stack-based buffer clash during tilde expansion in wordexp
- CVE-2026-6238Buffer overread in ns_printrrf with corrupted RDATA field
- CVE-2026-5435Potential buffer overflow in ns_sprintrrf TSIG handling path
- CVE-2026-5450scanf %mc off-by-one heap buffer overflow
- CVE-2026-5928Potential buffer under-read in ungetwc
- CVE-2026-4046iconv crash due to assertion failure with untrusted input
- CVE-2026-4438gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
- CVE-2026-4437gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
- CVE-2026-3904Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under h
- CVE-2025-15281wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
- CVE-2026-0915getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler
- CVE-2026-0861Integer overflow in memalign leads to heap corruption
- CVE-2025-8058The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails.
- CVE-2025-5745The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to
- CVE-2025-5702The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to
- CVE-2025-4802Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of
- CVE-2025-0395When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure mes
- CVE-2024-33602nscd: netgroup cache assumes NSS callback uses in-buffer strings