CVE-2026-18374

Medium

Description

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

SeverityMedium

CVSS4.9

Exploit probability—

ProductThe Gnu C Library Glibc

PublishedAug 27, 2026

First seenAug 27, 2026

Weakness typeCWE-787Out-of-bounds write

How to fix

Update

The GNU C Library glibc2.45 or later

Vendor advisories

sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015

Affected products

Product	Affected versions	Fixed in
The GNU C Library glibc	v < 2.45	2.45

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.