Input Buffer Overflow Vulnerability in GNU C Library

CVE-2026-115819

What is CVE-2026-115819?

The GNU C Library has an input buffer overflow vulnerability in the wide scanf family of functions. When using %s or %[ conversion without the required 'l' length modifier, a null byte is written one character past the designated end of a destination array. This occurs when the converted multibyte string entirely fills the array, resulting in an out-of-bounds write that can corrupt adjacent memory, leading to potential application crashes or data integrity issues. It is crucial for developers to implement appropriate input validation to prevent exploitation of this vulnerability.

References