CVE Intelligence
Analysis AI-assisted

CVE-2026-5450: GNU C Library (glibc) scanf %mc off-by-one heap buffer overflow

A one-byte heap buffer overflow in the GNU C Library (glibc) can be triggered through the scanf family when the %mc conversion is used with an explicit width greater than 1024. The record lists affected glibc versions from 2.7 up to and including 2.43 and a CVSS base score of 9.8. The record lists no fixed version and no confirmed active exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5450 is a one-byte heap buffer overflow in the GNU C Library (glibc). It is triggered through the scanf family of functions when the %mc conversion is used with an explicit width greater than 1024. The CNA record classifies the flaw as an out-of-bounds write (CWE-787).

Impact

  • The record describes a one-byte heap buffer overflow.
  • The CVSS base score of 9.8 is provided by both the CNA and CISA-ADP.
  • The SSVC data in the record lists technical impact as total. The record does not describe consequences beyond this.

Affected products and versions

  • The record lists GNU C Library (glibc) from 2.7 up to and including 2.43.
  • Two product entries appear: Gnu Glibc (from 2.7 up to and including 2.43) and GNU C Library Glibc (from 2.7).
  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists, so fix status is unknown from the record.

Exploitation status

  • The record shows this CVE is not listed in CISA KEV.
  • No confirmed active exploitation appears in the sources consulted.
  • The EPSS probability is 0.00718 (percentile 0.53358), dated 2026-10-23.
  • The SSVC exploitation field is 'poc'. A sourceware Bugzilla reference is tagged 'Exploit', but its contents were not reviewed.

Remediation and mitigation

  • Inventory systems that run glibc, especially those within the listed range.
  • Follow the vendor and distribution advisories linked in the references, such as the Siemens ProductCERT advisory and the libc-announce mailing list thread, to identify fixed builds.
  • Prioritize updates for internet-facing or privileged services that parse input with scanf-family functions.
  • Where updating cannot be immediate, review application code that uses %mc and limit untrusted input reaching those calls. This is a general defensive measure.

Detection guidance

  • Watch for unexpected crashes or signs of memory corruption in services linked against glibc.
  • In test environments, use memory-checking tooling for software that parses input with scanf.
  • Log and review anomalous input sent to parsing components, at a general level.

Limitations of the available information

  • The record does not give a fixed version or vendor-specific patch status.
  • The record does not describe exploitation conditions beyond the width condition, nor the achievable outcomes.
  • The two affected product entries use different names.
  • The source pages were not fetched directly; statements rely on the record.

Frequently asked questions

What is CVE-2026-5450?

It is a one-byte heap buffer overflow in the GNU C Library (glibc). It is triggered through the scanf family when the %mc conversion is used with an explicit width greater than 1024.

Which glibc versions are listed as affected?

The record lists versions from 2.7 up to and including 2.43. The record does not list a fixed version.

Is this vulnerability known to be actively exploited?

It is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted. One reference is tagged Exploit, but its contents were not reviewed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.