Memory Corruption Vulnerability in GNU C Library
CVE-2026-19542

5.6MEDIUM

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
14 September 2026

What is CVE-2026-19542?

A particular vulnerability exists within the tdelete function of the GNU C Library, versions 2.1 through 2.44. When processing a sufficiently deep tree, this function can cause an out-of-bounds write, leading to potential crashes. The tdelete function maintains a stack of parent nodes for rebalancing which does not properly check capacity, allowing an overflow if the stack becomes full. This scenario requires a specific tree depth and a large number of insertions and deletions, indicating an advanced manipulative attack on applications utilizing these library functions.

Affected Version(s)

glibc 2.1 <= 2.44

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34506
issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=ad...
vendor-advisory

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AISLE in partnership with Red Hat
.