7.3High

CVE-2026-5435Potential buffer overflow in ns_sprintrrf TSIG handling path

The GNU C Library glibc; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Published: 2026-04-28 14:58 (6 months ago)

Description

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

Weakness (CWE): CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
gnu	glibc	2.2 –
The GNU C Library	glibc	2.2
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 – < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5 – < V3.1.6
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 – < V3.1.6

References and patches

https://sourceware.org/bugzilla/show_bug.cgi?id=34033 issue-trackingIssue Tracking
https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u mailing-listThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

CPE matches (NVD) (1)

cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* ≥ 2.2

CVSS score

7.3High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

All scores (2)

CISA-ADP	CVSS 3.1	7.3High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.3High

EPSS (chance of exploitation in 30 days)

0.24%

higher than 15% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-04-02
Published2026-04-28 14:58
Reached IP-DB2026-10-24 23:44
Last updated2026-11-12 02:10

Assigned by (CNA): glibc
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — GNU C Library (glibc)

3.7Low

CVE-2026-100290 3 days ago

Double free after allocation failure in regcomp and regexec

The GNU C Library glibc

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node ta…

4.8Medium

CVE-2026-115819 3 days ago

One-byte buffer overflow in wide scanf %s and %[ conversions

The GNU C Library glibc

Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the…

5.9Medium

CVE-2026-122054 10 days ago

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

7.0High

CVE-2026-84243 15 days ago

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

3.7Low

CVE-2026-97399 1 month ago

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Low

CVE-2026-95818 1 month ago

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…