CVE-2026-5450

NameCVE-2026-5450
DescriptionCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glibc (PTS)bullseye2.31-13+deb11u11vulnerable
bullseye (security)2.31-13+deb11u13vulnerable
bookworm2.36-9+deb12u13vulnerable
bookworm (security)2.36-9+deb12u7vulnerable
trixie2.41-12+deb13u2vulnerable
forky2.42-14vulnerable
sid2.42-15vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
glibcsource(unstable)(unfixed)

Notes

[trixie] - glibc <no-dsa> (Minor issue)
[bookworm] - glibc <no-dsa> (Minor issue)
https://sourceware.org/bugzilla/show_bug.cgi?id=34008
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0009

Search for package or bug name: Reporting problems