CVE-2026-18374

Name of the Vulnerable Software and Affected Versions GNU C Library versions prior to 2.46

Description A heap buffer overflow can occur in the fopen() function when an effectively empty string is passed to the ,ccs= syntax extension of the mode argument, provided the mode string is controlled by an attacker. A heap buffer overflow is a memory corruption issue where data is written beyond the boundaries of a buffer allocated on the heap.

Recommendations Update to a version newer than 2.45. Validate any user-supplied values intended for the ccs extension before passing them to the fopen() function.