OESA-2026-2410

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2410

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2410.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2410

Upstream

CVE-2026-5450

CVE-2026-5928

Published

2026-05-22T13:18:59Z

Modified

2026-05-22T13:30:20.690092911Z

Summary

glibc security update

Details

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.(CVE-2026-5450)

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (IOwdefaultpbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->IOreadptr) instead of the actual wide-stream read pointer (fp->widedata->IOreadptr). The program crash may happen in cases where fp->IOreadptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:22.03-LTS-SP4 / glibc

Package

Name: glibc
Purl: pkg:rpm/openEuler/glibc&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.34-176.oe2203sp4

Ecosystem specific

{
    "noarch": [
        "glibc-help-2.34-176.oe2203sp4.noarch.rpm"
    ],
    "aarch64": [
        "glibc-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-all-langpacks-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-common-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-compat-2.17-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-debuginfo-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-debugsource-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-debugutils-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-devel-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-locale-archive-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-locale-source-2.34-176.oe2203sp4.aarch64.rpm",
        "glibc-nss-devel-2.34-176.oe2203sp4.aarch64.rpm",
        "libnsl-2.34-176.oe2203sp4.aarch64.rpm",
        "nscd-2.34-176.oe2203sp4.aarch64.rpm",
        "nss_modules-2.34-176.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "glibc-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-all-langpacks-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-common-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-compat-2.17-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-debuginfo-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-debugsource-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-debugutils-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-devel-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-locale-archive-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-locale-source-2.34-176.oe2203sp4.x86_64.rpm",
        "glibc-nss-devel-2.34-176.oe2203sp4.x86_64.rpm",
        "libnsl-2.34-176.oe2203sp4.x86_64.rpm",
        "nscd-2.34-176.oe2203sp4.x86_64.rpm",
        "nss_modules-2.34-176.oe2203sp4.x86_64.rpm"
    ],
    "src": [
        "glibc-2.34-176.oe2203sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2410.json"