CVE-2026-5450 - Vulnerability Details - OpenCVE
MAIN NAVIGATION
Vulnerabilities
Vendors & Products
Weaknesses
Statistics
Description
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Show more<br>Show less
Published:
2026-04-20
Score:
9.8 Critical
EPSS:
KEV:
No
Impact:
Heap Buffer Overflow (memory corruption)
Action:
Patch glibc
Analysis
Impact
The vulnerability occurs when an application invokes a scanf family function with the %mc conversion specifier and specifies an explicit width greater than 1024. This causes an off‑by‑one write on a heap buffer and can corrupt adjacent memory. The resulting memory corruption falls under CWE‑122, CWE‑131, and CWE‑787, and may lead to program crash, data integrity loss, or, if an attacker can influence subsequent execution, remote code execution.
Affected Systems
All systems that link against the GNU C Library between versions 2.7 and 2.43 are affected. This includes most Linux distributions, as well as applications compiled against these glibc releases. Users running binaries that compile with the unmodified library and that process external input via scanf with the %mc specifier are at risk.
Risk and Exploitability
The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation at present. The CVSS score of 9.8 reflects a high severity due to the potential for arbitrary memory overwrite on the heap. Based on the description, the likely attack vector is an attacker supplying crafted input that is handled by scanf with a large width, which may be local or remote depending on the application. Exploitation requires reaching the vulnerable scanf call, but because the overflow is only one byte, the difficulty is moderate; an attacker must control the input boundary to influence neighboring heap objects or trigger a crash. If an application can be coerced to execute arbitrary code after the heap corruption, privilege escalation or remote code execution may be achieved.
Mitre Data
CPE Configurations
Affected Packages
OpenCVE Enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
Vendor<br>Product<br>Default status<br>Versions
The GNU C Library<br>glibc
unaffected
Version<br>Status<br>Constraints
2.7
affected
Show more<br>Show less
Configuration 1 [-]
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
No data.
Vendor<br>Product<br>Confidence<br>Versions
The Gnu C Library
Glibc
100%
Version<br>Status<br>Scheme<br>Platform
[2.7,*]
affected
generic
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
Upgrade the GNU C Library to a patched release (e.g., glibc 2.44 or newer) that contains the bound‑checking fix for the %mc conversion specifier.
If an upgrade is not immediately possible, modify application code to avoid using scanf with the %mc specifier and an explicit width greater than 1024; replace with safer parsing routines such as fgets and manual length checks.
Ensure that memory protection mechanisms—including stack canaries, address space layout randomization, position‑independent executables, and hardware‑level memory safety features—are enabled on all affected binaries to mitigate the impact of potential residual corruption.
Generated by OpenCVE AI on April 28, 2026 at 21:32 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
CVSS v4.0 N/A
CVSS v3.1 9.8 Critical
CVSS v3.0 N/A
CVSS v2 N/A
KEV no
EPSS 0.00054
SSVC yes
No CVSS v4.0
Attack Vector<br>Network
Attack Complexity<br>Low
Privileges Required<br>None
Scope<br>Unchanged
Confidentiality Impact<br>High
Integrity Impact<br>High
Availability Impact<br>High
User Interaction<br>None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
The EPSS score is 0.00054 .
Exploitation<br>poc
Automatable<br>yes
Technical Impact<br>total
References
Link<br>Providers
https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2026-5450
https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450
https://www.cve.org/CVERecord?id=CVE-2026-5450
History
Thu, 23 Apr 2026 15:45:00 +0000
Type<br>Values Removed<br>Values Added
First Time appeared
Gnu
Gnu glibc
Weaknesses
CWE-787
CPEs
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
Vendors & Products
Gnu
Gnu glibc
Wed, 22 Apr 2026 12:15:00 +0000
Type<br>Values Removed<br>Values Added
Weaknesses
CWE-131
References
https://nvd.nist.gov/vuln/detail/CVE-2026-5450
https://www.cve.org/CVERecord?id=CVE-2026-5450
Metrics
threat_severity<br>None
threat_severity<br>Moderate
Wed, 22 Apr 2026...