CVE-2026-0861
HighCVSS 8.4Summary
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 to 2.42 may result in an integer overflow, which could consequently result in heap corruption. To exploit this, an attacker must control both the size and alignment arguments; the size must be close to PTRDIFF_MAX and the alignment in the range [1<<62+1, 1<<63] (exactly 1<<63 for posix_memalign and aligned_alloc). In practice, alignment is typically not attacker-controlled, making exploitation unlikely.
Risk Assessment
In typical applications alignment parameters are fixed, limiting exploitability. Risk increases in applications that incorrectly pass untrusted alignment values, potentially leading to memory corruption and possible code execution.
Recommendation
Upgrade glibc to a version containing the fix. Review application code for passing untrusted alignment values to memalign functions.
Other vulnerabilities in GNU C Library
See all- CVE-2024-2961High
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.
- CVE-2025-0395Medium
In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.
- CVE-2025-4802Medium
In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).
- CVE-2026-5450Critical
Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.
- CVE-2023-4911HighActively exploited
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- CVE-2020-6096High
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() with a negative value for the 'num' parameter results in a signed comparison vulnerability, potentially leading to out-of-bounds memory writes and remote code execution.
- CVE-2018-19591High
In the GNU C Library (glibc) through version 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
- CVE-2026-84243High
A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.
- CVE-2026-97399Low
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This occurs when attacker-controlled input strings match up to the edge of their page and the neighboring page is either not mapped or not readable.
- CVE-2026-8674Medium
Initializing the DNS stub resolver from /etc/resolv.conf or LOCALDOMAIN with a search list containing a domain of roughly 200 characters or more in GNU C Library versions 2.26 to 2.44 results in an assertion failure that aborts the process. The resolver truncates the search list when copying into the fixed-size _res.defdname buffer, but the consistency check compares against the wrong size and does not handle a first entry that does not fit, causing the assertion to fail.
Original NVD description (English source)
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS