Skip to content
OpenAdvisories
High · 8.4 CVE-2026-0861 EUVD-2026-2441GHSA-5pf6-63v3-88hw

Integer overflow in memalign leads to heap corruption

Published Jan 14, 2026 · Updated Apr 29, 2026 · Assigned by glibc

Vendor: The GNU C Library Product: glibc Package: glibc Package: glibc Package: glibc Package: glibc Package: glibc-2.43 Package: glibc-2.43-abi-report Package: glibc-2.43-dev Package: glibc-2.43-iconv Package: glibc-2.43-locale-ca Package: glibc-2.43-locale-de Package: glibc-2.43-locale-en Package: glibc-2.43-locale-es Package: glibc-2.43-locale-extra Package: glibc-2.43-locale-fr Package: glibc-2.43-locale-posix Package: glibc-2.43-locales Package: glibc-2.43-testresults Package: glibc-2.43-tracing Package: glibc-2.44 Package: glibc-2.44-abi-report Package: glibc-2.44-dev Package: glibc-2.44-iconv Package: glibc-2.44-locale-ca Package: glibc-2.44-locale-de Package: glibc-2.44-locale-en Package: glibc-2.44-locale-es Package: glibc-2.44-locale-extra Package: glibc-2.44-locale-fr Package: glibc-2.44-locale-posix Package: glibc-2.44-locales Package: glibc-2.44-testresults Package: glibc-2.44-tracing Package: ld-linux-2.43 Package: ld-linux-2.44 Package: libc-bin-2.43 Package: libc-bin-2.44 Package: libcrypt1-2.43 Package: libcrypt1-2.44 Package: localedef-2.43 Package: localedef-2.44 Package: nscd-2.43 Package: nscd-2.44 Package: nss-db-2.43 Package: nss-db-2.44 Package: nss-hesiod-2.43 Package: nss-hesiod-2.44 Package: pcprofiledump-2.43 Package: pcprofiledump-2.44 Package: posix-libc-utils-2.43 Package: posix-libc-utils-2.44 Package: posix-libc-utils-bin-2.43 Package: posix-libc-utils-bin-2.44 Package: sln-2.43 Package: sln-2.44 Package: sotruss-2.43 Package: sotruss-2.44 Package: tzutils-2.43 Package: tzutils-2.44 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.

Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Affected products

VendorProductAffectedFixed
The GNU C Library glibc 2.30 – ≤ 2.42 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 glibc 2.42-8 —
Debian 13 glibc 2.41-12+deb13u2 —
Debian 12 glibc 2.36-9+deb12u14 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 glibc 2.42-0ubuntu3.1 —
Ubuntu 24.04 LTS glibc 2.39-0ubuntu8.7 —
Ubuntu 22.04 LTS glibc 2.35-0ubuntu3.13 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS glibc 2.31-0ubuntu9.18+esm1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 glibc +220 2.39-58.el10_1.7 RHSA-2026:1334
RHEL 9 glibc +1 2.34-231.el9_7.10 RHSA-2026:2786
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 glibc +223 2.42-11.1.hum1 RHSA-2026:7316

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 glibc-doc 2.39-58.el10_1.7.alma.1 ALSA-2026:1334
AlmaLinux 9 nscd +214 2.34-231.el9_7.10 ALSA-2026:2786

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 glibc 2.39-58.el10_1.7 RLSA-2026:1334
Rocky Linux 9 glibc 2.34-231.el9_7.10 RLSA-2026:2786

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 glibc 2.38-150600.14.40.1 SUSE-SU-2026:0371-1
SLES 15 SP6 glibc 2.38-150600.14.40.1 SUSE-SU-2026:0371-1
SLES 15 SP5 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLES 15 SP4 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
Show 18 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 glibc 2.40-160000.3.1 SUSE-SU-2026:20198-1
SLES for SAP 15 SP6 glibc 2.38-150600.14.40.1 SUSE-SU-2026:0371-1
SLES for SAP 15 SP5 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLES for SAP 15 SP4 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLES 16.0 glibc 2.40-160000.3.1 SUSE-SU-2026:20198-1
SLE Micro 6.2 glibc 2.40-160000.3.1 SUSE-SU-2026:20563-1, SUSE-SU-2026:20178-1
SLE Micro 6.1 glibc 2.38-slfo.1.1_6.1 SUSE-SU-2026:20536-1
SLE Micro 6.0 glibc 2.38-11.1 SUSE-SU-2026:20527-1
SLE Micro 5.5 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLE Micro 5.4 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLE Micro 5.3 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLE Micro 5.2 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLE Live Patching 15 SP7 glibc-livepatches 0.3-150700.10.4.1 SUSE-SU-2026:0827-1
SLE Live Patching 15 SP6 glibc-livepatches 0.3-150600.8.2.1 SUSE-SU-2026:0499-1
SLE Live Patching 15 SP5 glibc-livepatches 0.3-150400.3.11.1 SUSE-SU-2026:0347-1
SLE Live Patching 15 SP4 glibc-livepatches 0.3-150400.3.11.1 SUSE-SU-2026:0347-1
SLE HPC 15 SP5 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1
SLE HPC 15 SP4 glibc 2.31-150300.98.1 SUSE-SU-2026:0896-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed glibc 2.43-1.1 openSUSE-SU-2026:10662-1
openSUSE Leap 16.0 glibc +4 2.40-160000.3.1 openSUSE-SU-2026:20133-1
openSUSE Leap 15.6 glibc 2.38-150600.14.40.1 SUSE-SU-2026:0371-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 glibc 2.38-18 —
Azure Linux 2 (CBL-Mariner) glibc 2.35-9 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 glibc +220 2.39-58.0.1.el10_1.7 ELSA-2026-1334
Oracle Linux 9 nscd +214 2.34-231.0.1.el9_7.10 ELSA-2026-2786

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling glibc +54 2.42-r6 —

Advisories 28

References