Skip to content
OpenAdvisories
High · 7.5 CVE-2026-5928 EUVD-2026-23980GHSA-829p-mc9m-7xhr

Potential buffer under-read in ungetwc

Published Apr 20, 2026 · Updated Oct 15, 2026 · Assigned by glibc

Vendor: The GNU C Library Product: glibc Package: eglibc Package: glibc Package: glibc Package: glibc Package: glibc Package: glibc-2.43 Package: glibc-2.43-dev Package: glibc-2.43-iconv Package: glibc-2.43-locale-ca Package: glibc-2.43-locale-de Package: glibc-2.43-locale-en Package: glibc-2.43-locale-es Package: glibc-2.43-locale-extra Package: glibc-2.43-locale-fr Package: glibc-2.43-locale-posix Package: glibc-2.43-locales Package: glibc-2.43-testresults Package: glibc-2.43-tracing Package: glibc-dev Package: glibc-iconv Package: glibc-locale-ca Package: glibc-locale-de Package: glibc-locale-en Package: glibc-locale-es Package: glibc-locale-extra Package: glibc-locale-fr Package: glibc-locale-posix Package: glibc-locales Package: glibc-testresults Package: glibc-tracing Package: ld-linux Package: ld-linux-2.43 Package: libc-bin Package: libc-bin-2.43 Package: libcrypt1 Package: libcrypt1-2.43 Package: localedef Package: localedef-2.43 Package: nscd Package: nscd-2.43 Package: nss-db Package: nss-db-2.43 Package: nss-hesiod Package: nss-hesiod-2.43 Package: pcprofiledump Package: pcprofiledump-2.43 Package: posix-libc-utils Package: posix-libc-utils-2.43 Package: posix-libc-utils-bin Package: posix-libc-utils-bin-2.43 Package: sln Package: sln-2.43 Package: sotruss Package: sotruss-2.43 Package: tzutils Package: tzutils-2.43 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.

A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.

Affected products

VendorProductAffectedFixed
The GNU C Library glibc 2.1.1-89 – ≤ 2.43 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 glibc 2.42-17 —
Debian 13 glibc 2.41-12+deb13u4 —
Debian 12 glibc No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS glibc 2.43-2ubuntu2.3 USN-8611-1
Ubuntu 25.10 glibc No fix yet —
Ubuntu 24.04 LTS glibc 2.39-0ubuntu8.8 USN-8611-1
Ubuntu 22.04 LTS glibc 2.35-0ubuntu3.14 USN-8611-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS glibc No fix yet —
Ubuntu Pro 18.04 LTS glibc No fix yet —
Ubuntu Pro 16.04 LTS glibc No fix yet —
Ubuntu Pro 14.04 LTS eglibc No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 glibc +220 2.39-128.el10_2 RHSA-2026:42694
RHEL 9 nscd +214 2.34-274.el9_8 RHSA-2026:42952
RHEL 8 nscd +213 2.28-251.el8_10.40 RHSA-2026:42733
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 glibc +223 2.42-12.hum1 RHSA-2026:12740

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 glibc +220 2.39-128.el10_2.alma.1 ALSA-2026:42694
AlmaLinux 9 nscd +214 2.34-274.el9_8 ALSA-2026:42952
AlmaLinux 8 nscd +213 2.28-251.el8_10.40 ALSA-2026:42733

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 glibc 2.39-128.el10_2 RLSA-2026:42694
Rocky Linux 9 glibc 2.34-274.el9_8 RLSA-2026:42952
Rocky Linux 8 glibc 2.28-251.el8_10.40 RLSA-2026:42733

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLES 15 SP4 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLES 12 SP5 glibc 2.22-114.46.1 SUSE-SU-2026:2440-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLES for SAP 15 SP4 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLE Micro 6.2 glibc 2.40-160000.5.1 SUSE-SU-2026:21780-1
SLE Micro 5.5 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLE Micro 5.4 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLE Micro 5.3 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLE HPC 15 SP5 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1
SLE HPC 15 SP4 glibc 2.31-150300.101.1 SUSE-SU-2026:2333-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed glibc 2.43-3.1 openSUSE-SU-2026:10770-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 glibc No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 glibc +220 2.39-128.0.1.el10_2 ELSA-2026-42694
Oracle Linux 9 nscd +214 2.34-274.0.1.el9_8 ELSA-2026-42952
Oracle Linux 8 nscd +213 2.28-251.0.4.el8_10.40 ELSA-2026-42733

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling sln +51 2.43-r7 —

Advisories 22

References