DEBIAN-CVE-2026-5450

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-5450
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5450.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-5450
Upstream
Published
2026-04-20T21:16:36Z
Modified
2026-09-14T17:03:45Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

References

Affected packages

Debian:12 / glibc

Package

Name
glibc
Purl
pkg:deb/debian/glibc?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.36-9
2.36-9+deb12u1
2.36-9+deb12u2
2.36-9+deb12u3
2.36-9+deb12u4
2.36-9+deb12u5
2.36-9+deb12u6
2.36-9+deb12u7
2.36-9+deb12u8
2.36-9+deb12u9
2.36-9+deb12u10
2.36-9+deb12u11
2.36-9+deb12u12
2.36-9+deb12u13
2.36-9+deb12u14
2.36-9+loong64
2.36-10~0
2.37-1
2.37-2
2.37-3
2.37-4
2.37-5
2.37-6
2.37-7
2.37-8
2.37-9
2.37-10
2.37-11
2.37-12
2.37-13
2.37-14
2.37-15~deb13u1
2.37-15
2.37-15.1
2.37-15.1+sh4
2.37-16
2.37-17
2.37-18
2.37-19
2.38-1
2.38-2
2.38-3
2.38-4
2.38-5
2.38-6
2.38-7~0+hurd.1
2.38-7
2.38-8
2.38-9
2.38-10
2.38-11
2.38-12
2.38-12.1
2.38-13
2.38-14
2.38-15~0
2.38-15~1
2.39-1
2.39-2
2.39-3
2.39-3.1
2.39-4
2.39-5
2.39-6
2.39-6+hurd.1
2.39-6+sh4
2.39-7~0
2.39-7
2.39-7+sh4
2.39-8~0
2.40-1
2.40-2
2.40-2+sh4
2.40-3
2.40-3+sh4
2.40-4
2.40-5~hurd.1
2.40-5
2.40-6~1
2.40-6
2.40-7
2.41-1
2.41-2
2.41-3
2.41-4~0
2.41-4
2.41-5~0
2.41-5
2.41-6
2.41-7
2.41-8~0
2.41-8~1
2.41-8
2.41-9~0
2.41-9~1
2.41-9
2.41-10
2.41-11
2.41-12
2.41-13~hurd.0
2.41-13~hurd.1
2.42-1
2.42-2
2.42-3
2.42-4
2.42-5
2.42-6
2.42-7
2.42-8~hurd.1
2.42-8~hurd.2
2.42-8
2.42-9
2.42-10
2.42-11
2.42-12~hurd.1
2.42-12
2.42-13
2.42-14~hurd.1
2.42-14
2.42-15~hurd.1
2.42-15
2.42-16
2.42-17
2.43-1
2.43-2
2.43-3
2.43-3+m68k
2.43-4
2.43-4+m68k
2.43-5
2.44-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5450.json"

Debian:13 / glibc

Package

Name
glibc
Purl
pkg:deb/debian/glibc?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.41-12+deb13u4

Affected versions

2.*
2.41-12
2.41-12+deb13u1
2.41-12+deb13u2
2.41-12+deb13u3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5450.json"

Debian:14 / glibc

Package

Name
glibc
Purl
pkg:deb/debian/glibc?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.42-17

Affected versions

2.*
2.41-12
2.41-13~hurd.0
2.41-13~hurd.1
2.42-1
2.42-2
2.42-3
2.42-4
2.42-5
2.42-6
2.42-7
2.42-8~hurd.1
2.42-8~hurd.2
2.42-8
2.42-9
2.42-10
2.42-11
2.42-12~hurd.1
2.42-12
2.42-13
2.42-14~hurd.1
2.42-14
2.42-15~hurd.1
2.42-15
2.42-16

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5450.json"