CVE-2026-18374
MEDIUM 4.9 ALL-YEARSPassing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
LIMITED SIGNALS
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 4th percentile
○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no
Impact if exploited
4.9CVSS 3.1 · MEDIUM · CNA
- ConfidentialityLow
- IntegrityLow
- AvailabilityLow
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-787: Out-of-bounds write
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
References and research data (JSON)
Vendor product assessments
Showing 32 of 3505 vendor product statements; 3473 omitted. Read the full vendor advisory.
glibc-benchtests-debuginfo-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-ar-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-hi-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-ne-0:2.39-145.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-to-0:2.39-145.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_2?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-be-0:2.28-251.el8_10.48.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10.48?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-hy-0:2.28-251.el8_10.48.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10.48?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-or-0:2.28-251.el8_10.48.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10.48?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-wae-0:2.28-251.el8_10.48.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_10.48?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-ca-0:2.34-283.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-kl-0:2.34-283.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-rw-0:2.34-283.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-utils-debuginfo-0:2.34-283.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nss_hesiod-debuginfo-0:2.34-283.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]_8?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
glibc-langpack-mai-0:2.43-8.5.hum1@x86_64 as a component of Red Hat Hardened Images · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
registry.redhat.io/rhui5/rhua-rhel9@sha256:fa09f523d2501e42f9c78c18bd99475f562e7397ed75d8c0fc8e183bcbf4c827_amd64 as a component of Red Hat Update Infrastructure 5 · fixed
Vendor assessment for this product only.
pkg:oci/rhua-rhel9@sha256%3Afa09f523d2501e42f9c78c18bd99475f562e7397ed75d8c0fc8e183bcbf4c827?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-rhel9&tag=1791978693
- vendor fix: The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Vendor guidance
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
compat-glibc-headers as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/compat-glibc-headers
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
compat-glibc.src as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/compat-glibc?arch=src
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-common as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-common
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-devel as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-devel
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-static as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-static
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-utils as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-utils
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
nscd as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nscd
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
compat-glibc as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/compat-glibc
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
compat-glibc-headers as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/compat-glibc-headers
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-common as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-common
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-headers as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-headers
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc-static as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc-static
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
glibc.src as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/glibc?arch=src
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
nscd as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/nscd
- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
- none available: Fix deferred
filesystem.src as a component of Red Hat Hardened Images · known not affected
Vendor assessment for this product only.
Reason: component not present
pkg:rpm/redhat/filesystem?arch=src
Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
All CVSS metrics
- MEDIUM 4.9 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - MEDIUM 4.9 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
References
Advisories
- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015 CVE record · glibc · Updated 2026-08-27T19:26:33.518Z
NVD · CVE-2026-18374 · Updated 2026-09-03T16:43:15.293
Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18374.json Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67222 EUVD · EUVD-2026-67222
Technical & other
- https://sourceware.org/bugzilla/show_bug.cgi?id=34574 CVE record · glibc · Updated 2026-08-27T19:26:33.518Z
NVD · CVE-2026-18374 · Updated 2026-09-03T16:43:15.293
Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00 - http://www.openwall.com/lists/oss-security/2026/08/27/6CVE record · CVE · Updated 2026-08-27T22:21:53.526Z
NVD · CVE-2026-18374 · Updated 2026-09-03T16:43:15.293 - https://access.redhat.com/security/cve/CVE-2026-18374 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2525256 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-18374 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-18374 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://access.redhat.com/errata/RHSA-2026:84753 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://access.redhat.com/errata/RHSA-2026:80798 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://access.redhat.com/errata/RHSA-2026:79281 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://access.redhat.com/errata/RHSA-2026:65339 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://access.redhat.com/errata/RHSA-2026:82939 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
- https://access.redhat.com/errata/RHSA-2026:87400 Red Hat · CVE-2026-18374 · Updated 2026-10-22T05:50:44+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS