Detections
Analytics

Echo: glibc: security update to 2.41-12+deb13u2+e4

high Tenable Self-Hosted Container Security Plugin ID 461042

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has
 overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or
 earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in
 unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character
 pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the
 regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer
 (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not
 initialized and hence points to NULL. The buffer under-read requires a special situation where the input
 character encoding is such that there are overlaps between single byte representations and multibyte
 representations in that encoding, resulting in spurious matches. The spurious match case is not possible
 in the standard Unicode character sets. (CVE-2026-5928)

Solution

Update the glibc library and its related packages to version 2.41-12+deb13u2+e4 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-5928

Plugin Details

Severity: High

ID: 461042

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 3.7

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:N/A:C

CVSS Score Source: CVE-2026-5928

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/21/2026

Vulnerability Publication Date: 2/5/2026

Reference Information

CVE: CVE-2026-5928

IAVA: 2026-A-0102-S