Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0371-1 advisory.

    Security fixes:

    - CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow     (bsc#1256766).
    - CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in
    _nss_dns_getnetbyaddr_r (bsc#1256822).
    - CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

    Other fixes:

    - NPTL: Optimize trylock for high cache contention workloads (bsc#1256437).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20198-1 advisory.

    Security fixes:

    - CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
    - CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow     (bsc#1256766).
    - CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in
    _nss_dns_getnetbyaddr_r (bsc#1256822).
    - CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

    Other fixes:

    - NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8005-1 advisory.

    Vitaly Simonovich discovered that the GNU C Library did not properly initialize the input when WRDE_REUSE     is used. An attacker could possibly use this issue to cause applications to crash, leading to a denial of     service. (CVE-2025-15281)

    Anastasia Belova discovered that the GNU C Library incorrectly handled the regcomp function when memory     allocation failures occured. An attacker could possibly use this issue to cause applications to crash,     leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04     LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-8058)

    Igor Morgenstern discovered that the GNU C Library incorrectly handled the memalign function when doing     memory allocation. An attacker could possibly use this issue to cause applications to crash, leading to a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0861)

    Igor Morgenstern discovered that the GNU C Library incorrectly handled certain DNS backend when queries     for a zero-valued network. An attacker could possibly use this issue to cause a denial of service or     obtain sensitive information. (CVE-2026-0915)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20133-1 advisory.

    Security fixes:

    - CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
    - CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow     (bsc#1256766).
    - CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in
    _nss_dns_getnetbyaddr_r (bsc#1256822).
    - CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

    Other fixes:

    - NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0347-1 advisory.

    - CVE-2026-0861: Fixed that inadequate size check in the memalign suite may result in an integer overflow     (bsc#1256913)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1334 advisory.

    * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861)

    * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50078 advisory.

    - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141848)
    - CVE-2026-0861: Check for alignment overflow in memalign functions       (RHEL-141732)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1334 advisory.

    * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861)
      * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0037 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-0861:
    Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign,     aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could     consequently result in a heap corruption.

    Note that the attacker must have control over both, the size as well as the alignment arguments of the     memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so     as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the     alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and     aligned_alloc.

    Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size,     block size, struct sizes) and is not attacker controlled, because of which this may not be easily     exploitable in practice.  An application bug could potentially result in the input alignment being too     large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent     libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1334 advisory.

    - CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141848)
    - CVE-2026-0861: Check for alignment overflow in memalign functions       (RHEL-141732)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1334 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861)

    * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a2f3af8a86 advisory.

    This update switches the currency symbol for Bulgaria to the Euro.

    Furthermore, it addresses several security vulnerabilities:

    * A crash when `wordexp` is used with `WRDE_REUSE` (CVE-2025-15281)
    * Information leakage from the stack if `getnetbyaddr` is called for the zero address (CVE-2026-0915)
    * An integer overflow in `memalign` and related functions if they are called with out-of-bounds     size/alignment combinations (CVE-2026-0861)
    * `LD_PROFILE` is now ignored with a warning if `LD_PROFILE_OUTPUT` is not specified, rather than using     the insecure `/var/tmp` default.

    The changes updates from the upstream stable release branch are applied:

    * nptl: Optimize trylock for high cache contention workloads (BZ #33704) (Sunil K Pandey)
    * sprof: fix -Wformat warnings on 32-bit hosts (Collin Funk)
    * sprof: check pread size and offset for overflow (DJ Delorie)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-205d532069 advisory.

    This update switches the currency symbol for Bulgaria to the Euro.

    Furthermore, it addresses several security vulnerabilities:

    * A crash when `wordexp` is used with `WRDE_REUSE` (CVE-2025-15281)
    * Information leakage from the stack if `getnetbyaddr` is called for the zero address (CVE-2026-0915)
    * An integer overflow in `memalign` and related functions if they are called with out-of-bounds     size/alignment combinations (CVE-2026-0861)
    * `LD_PROFILE` is now ignored with a warning if `LD_PROFILE_OUTPUT` is not specified, rather than using     the insecure `/var/tmp` default.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign,     aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could     consequently result in a heap corruption. Note that the attacker must have control over both, the size as     well as the alignment arguments of the memalign function to be able to exploit this. The size parameter     must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This     limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly     1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a     known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled,     because of which this may not be easily exploitable in practice. An application bug could potentially     result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow     in the application or its dependent libraries, but that is again an uncommon usage pattern given typical     sources of alignments. (CVE-2026-0861)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297974	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2026:0371-1)	Nessus	SuSE Local Security Checks	high
297846	SUSE SLES16 Security Update : glibc (SUSE-SU-2026:20198-1)	Nessus	SuSE Local Security Checks	high
297802	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : GNU C Library vulnerabilities (USN-8005-1)	Nessus	Ubuntu Local Security Checks	medium
297781	openSUSE 16 Security Update : glibc (openSUSE-SU-2026:20133-1)	Nessus	SuSE Local Security Checks	high
297434	Photon OS 5.0: Glibc PHSA-2026-5.0-0749	Nessus	PhotonOS Local Security Checks	high
297425	SUSE SLES15 Security Update : glibc-livepatches (SUSE-SU-2026:0347-1)	Nessus	SuSE Local Security Checks	high
297280	RockyLinux 10 : glibc (RLSA-2026:1334)	Nessus	Rocky Linux Local Security Checks	high
297158	Oracle Linux 10 : glibc (ELSA-2026-50078)	Nessus	Oracle Linux Local Security Checks	high
297135	AlmaLinux 10 : glibc (ALSA-2026:1334)	Nessus	Alma Linux Local Security Checks	high
297112	TencentOS Server 4: glibc (TSSA-2026:0037)	Nessus	Tencent Local Security Checks	high
296991	Oracle Linux 10 : glibc (ELSA-2026-1334)	Nessus	Oracle Linux Local Security Checks	high
296697	RHEL 10 : glibc (RHSA-2026:1334)	Nessus	Red Hat Local Security Checks	high
296672	Fedora 42 : glibc (2026-a2f3af8a86)	Nessus	Fedora Local Security Checks	high
296551	Fedora 43 : glibc (2026-205d532069)	Nessus	Fedora Local Security Checks	high
286817	Linux Distros Unpatched Vulnerability : CVE-2026-0861	Nessus	Misc.	high

Detections

Analytics

CVE-2026-0861

high

Tenable Plugins

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high