The GNU C Library
The GNU C Library Security Releases - April 2026
the-gnu-c-library-2026-04 Apr 1, 2026 Source: Vendor
The GNU C Library security advisories for April 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-5435
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-5435
BR2026-0000-032276
glibc
unclaimed
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write...
Credited as shinobu
CVE-2026-5450
BR2026-0000-032277
glibc
unclaimed
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 c...
Credited as Rocket Ma
CVE-2026-5928
BR2026-0000-032278
glibc
unclaimed
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library vers...
Credited as Rocket Ma