CVE-2026-18374

Name	CVE-2026-18374
Description	Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1146721

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glibc (PTS)	bookworm	2.36-9+deb12u14	vulnerable
	bookworm (security)	2.36-9+deb12u7	vulnerable
	trixie	2.41-12+deb13u4	vulnerable
	forky, sid	2.43-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glibc	source	(unstable)	2.43-5			1146721

Notes

[trixie] - glibc <no-dsa> (Minor issue)
[bookworm] - glibc <postponed> (Minor issue)
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0015