CVE-2026-115819

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.2 through 2.44

Description An issue exists when calling the wide scanf family of functions (swscanf(), fwscanf(), wscanf(), vswscanf(), vfwscanf(), and vwscanf()) using a %s or %[ conversion without the l length modifier. When a converted multibyte string and its terminating null byte exactly fill the destination array, the functions write an additional null byte one byte past the end of the array. This out-of-bounds write can lead to adjacent data corruption or process crashes. The issue affects all supported architectures and ABIs.

Recommendations Update GNU C Library to a version later than 2.44. As a temporary workaround, avoid using %s or %[ conversions without the l length modifier in the swscanf(), fwscanf(), wscanf(), vswscanf(), vfwscanf(), and vwscanf() functions.