9.8Kritik

CVE-2026-5450scanf %mc off-by-one heap buffer overflow

The GNU C Library glibc; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Yayım: 2026-04-20 23:55 (6 ay önce)

Açıklama

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

Zayıflık türü (CWE): CWE-122 CWE-787

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
gnu	glibc	2.7 – ≤ 2.43
The GNU C Library	glibc	2.7
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 – < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5 – < V3.1.6
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 – < V3.1.6

Kaynaklar ve yamalar

https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450 issue-trackingExploitIssue Tracking
https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u mailing-listThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-082556.html

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* ≥ 2.7 ≤ 2.43

CVSS puanı

9.8Kritik

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	9.8Kritik
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritik

EPSS (30 günde istismar olasılığı)

0.50%

tüm CVE'lerin %44'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-04-02
Yayımlandı2026-04-20 23:55
IP-DB'ye ulaştı2026-10-24 23:44
Son güncelleme2026-11-12 02:10

Numarayı veren (CNA): glibc
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — GNU C Library (glibc)

3.7Düşük

CVE-2026-100290 4 gün önce

Double free after allocation failure in regcomp and regexec

The GNU C Library glibc

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node ta…

4.8Orta

CVE-2026-115819 4 gün önce

One-byte buffer overflow in wide scanf %s and %[ conversions

The GNU C Library glibc

Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the…

5.9Orta

CVE-2026-122054 11 gün önce

BIG-HKSCS decoding hang on crafted input

The GNU C Library glibc

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

7.0Yüksek

CVE-2026-84243 16 gün önce

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

3.7Düşük

CVE-2026-97399 1 ay önce

One-byte overread in strncasecmp on Power8

The GNU C Library glibc

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to th…

3.6Düşük

CVE-2026-95818 1 ay önce

AT_SECURE program buffer overflow via $ORIGIN processing

The GNU C Library glibc

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH beg…