Summary
It was discovered that the GNU C Library iconv function incorrectly handled
certain IBM character sets. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-4046)
It was discovered that the GNU C Library DNS functions incorrectly handled
certain DNS server responses when using gethostbyaddr or gethostbyaddr_r.
An attacker in a privileged network position could possibly use this issue
to cause an application to violate DNS specification or obtain incorrect
hostname information. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-4437, CVE-2026-4438)
It was discovered that the GNU C Library deprecated debugging functions
incorrectly enforced caller-supplied buffer lengths. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-5435)
It was discovered that the GNU C Library scanf family of functions
contained a heap buffer overflow when processing certain format specifiers.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. (CVE-2026-5450)
It was discovered that the GNU C Library ungetwc function incorrectly
handled certain character encodings. An attacker could possibly use this
issue to obtain sensitive information or cause a denial of service.
(CVE-2026-5928)
It was discovered that the GNU C Library deprecated debugging functions
incorrectly validated DNS response record data. An attacker could possibly
use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-6238)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | glibc | 2.35-0ubuntu3.14 |
| Ubuntu · 24.04 LTS 24.04:LTS | glibc | 2.39-0ubuntu8.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | glibc | 2.43-2ubuntu2.3 |
Vulnerabilities 7
-
Critical 9.8
scanf %mc off-by-one heap buffer overflow
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
-
High 7.5
iconv crash due to assertion failure with untrusted input
The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be triviall…
-
High 7.5
gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS…
-
High 7.5
Potential buffer under-read in ungetwc
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes be…
-
High 7.3
Potential buffer overflow in ns_sprintrrf TSIG handling path
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
-
Medium 6.5
Buffer overread in ns_printrrf with corrupted RDATA field
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allo…
-
Medium 5.4
gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS sp…
References
-
report
https://ubuntu.com/security/CVE-2026-4046
-
report
https://ubuntu.com/security/CVE-2026-4437
-
report
https://ubuntu.com/security/CVE-2026-4438
-
report
https://ubuntu.com/security/CVE-2026-5435
-
report
https://ubuntu.com/security/CVE-2026-5450
-
report
https://ubuntu.com/security/CVE-2026-5928
-
report
https://ubuntu.com/security/CVE-2026-6238