glibc <2.45 Heap Buffer Overflow via fopen mode 'ccs'
CVE-2026-18374 Published on August 27, 2026
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Vulnerability Analysis
CVE-2026-18374 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-18374 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-18374
Want to know whenever a new CVE is published for GNU Glibc? stack.watch will email you.
Affected Versions
The GNU C Library glibc:- Before 2.45 is affected.