CVE-2026-5450

critical

Description

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

References

https://inbox.sourceware.org/libc-announce/[email protected]/T/#u

https://www.helpnetsecurity.com/2026/09/14/debian-13-7-point-release/

https://github.com/cwayne18/vexscan

https://github.com/BarAppTeam/nginx-cve-fix

https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Details

Source: Mitre, NVD

Published: 2026-04-20

Updated: 2026-07-14

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H