glibc

Latest CVEs · RSS

• CVE-2026-97399 2026-09-28 · CVSS 3.7
  The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may cras
• CVE-2026-95818 2026-09-22 · CVSS 3.6
  A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt
• CVE-2026-86805 2026-09-22 · CVSS 6.3
  A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local atta
• CVE-2026-8674 2026-09-17 · CVSS 5.3
  Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 char
• CVE-2026-80489 2026-09-15 · CVSS 5.9
  Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may res
• CVE-2026-77117 2026-09-15 · CVSS 5.9
  Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may r
• CVE-2026-19542 2026-09-14 · CVSS 5.6
  Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stac
• CVE-2026-19499 2026-09-14 · CVSS 7.7
  Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right
• CVE-2026-89092 2026-09-11 · CVSS 4.2
  The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query
• CVE-2026-18374 2026-08-27 · CVSS 4.9
  Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier ma
• CVE-2026-6791 2026-08-10 · CVSS 6.6
  When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home di
• CVE-2026-6368 2026-08-10 · CVSS 2.1
  Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which
• CVE-2026-6238 2026-04-28
  The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the
• CVE-2026-5435 2026-04-28
  The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and
• CVE-2026-5450 2026-04-20
  Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with
• CVE-2026-5928 2026-04-20
  Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character
• CVE-2026-4046 2026-03-30
  The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 cha
• CVE-2026-4438 2026-03-20
  Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2
• CVE-2026-4437 2026-03-20
  Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2
• CVE-2026-3904 2026-03-11
  Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64
• CVE-2025-15281 2026-01-20
  Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized
• CVE-2026-0915 2026-01-15
  Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued netwo
• CVE-2026-0861 2026-01-14
  Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result
• CVE-2025-8058 2025-07-23 · CVSS 5.9
  The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished eithe
• CVE-2025-5745 2025-06-05
  The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving