Summary
It was discovered that the GNU C Library incorrectly handled the ccs=
option in the fopen function. An attacker could possibly use this issue
to cause GNU C Library to crash or execute arbitrary code.
(CVE-2026-18374)
It was discovered that the GNU C Library incorrectly handled long domain
names in DNS search lists. An attacker on the local network could
possibly use this issue to cause GNU C Library to crash, resulting in a
denial of service. (CVE-2026-8674)
It was discovered that the GNU C Library dynamic loader had a
time-of-check to time-of-use race condition when handling the $ORIGIN
path expansion in setuid or setgid programs. A local attacker could
possibly use this issue to execute arbitrary code with elevated
privileges. (CVE-2026-86805)
It was discovered that the GNU C Library dynamic loader incorrectly
handled $ORIGIN path expansion, leading to a stack-based buffer
overflow. A local attacker could possibly use this issue to cause GNU C
Library to crash, resulting in a denial of service, or obtain sensitive
information. (CVE-2026-95818)
It was discovered that the GNU C Library nscd service incorrectly
handled large DNS responses. An attacker could possibly use this issue
to cause nscd to crash, resulting in a denial of service.
(CVE-2026-89092)
It was discovered that the GNU C Library strncasecmp function optimized
for the Power8 architecture incorrectly handled certain inputs. An
attacker could possibly use this issue to cause GNU C Library to crash,
resulting in a denial of service. (CVE-2026-97399)
It was discovered that the GNU C Library incorrectly restricted path
traversal when processing the LANGUAGE environment variable in gettext.
A local attacker could possibly use this issue to load message catalogs
from arbitrary locations and execute arbitrary code.
(CVE-2026-84243)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | glibc | 2.35-0ubuntu3.18 |
| Ubuntu · 24.04 LTS 24.04:LTS | glibc | 2.39-0ubuntu8.12 |
| Ubuntu · 26.04 LTS 26.04:LTS | glibc | 2.43-2ubuntu2.7 |
| Ubuntu · 26.10 | glibc | 2.44-1ubuntu2.1 |
Vulnerabilities 7
-
High 7.0
gettext: Directory traversal via the LANGUAGE environment variable
The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the env…
-
Medium 6.3
AT_SECURE programs may load attacker-controlled code via $ORIGIN
A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) progr…
-
Medium 5.3
Assertion failure in the DNS stub resolver with a long search domain
Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which abor…
-
Medium 4.9
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the…
-
Medium 4.2
Stack overflow in nscd due to unbounded alloca use
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that h…
-
Low 3.7
One-byte overread in strncasecmp on Power8
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the…
-
Low 3.6
AT_SECURE program buffer overflow via $ORIGIN processing
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begi…
References
-
report
https://ubuntu.com/security/CVE-2026-8674
-
report
https://ubuntu.com/security/CVE-2026-18374
-
report
https://ubuntu.com/security/CVE-2026-84243
-
report
https://ubuntu.com/security/CVE-2026-86805
-
report
https://ubuntu.com/security/CVE-2026-89092
-
report
https://ubuntu.com/security/CVE-2026-95818
-
report
https://ubuntu.com/security/CVE-2026-97399