CVE-2026-3904

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 to 2.42 may result in an integer overflow, which could consequently result in heap corruption. To exploit this, an attacker must control both the size and alignment arguments; the size must be close to PTRDIFF_MAX and the alignment in the range [1<<62+1, 1<<63] (exactly 1<<63 for posix_memalign and aligned_alloc). In practice, alignment is typically not attacker-controlled, making exploitation unlikely.

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.

In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() with a negative value for the 'num' parameter results in a signed comparison vulnerability, potentially leading to out-of-bounds memory writes and remote code execution.

In the GNU C Library (glibc) through version 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.

A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This occurs when attacker-controlled input strings match up to the edge of their page and the neighboring page is either not mapped or not readable.