CVE-2026-18374

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in GNU C Library fopen

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: GNU C Library

Description

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-18374

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	gnu_c_library	2.45
gnu	gnu_c_library	to 2.45 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a heap buffer overflow in the GNU C Library's fopen function when an attacker-controlled empty string is passed via the ,ccs= syntax extension in the mode argument. This occurs in versions 2.45 or earlier.

Detection Guidance

This vulnerability involves a heap buffer overflow in the GNU C Library's fopen function when processing an empty string with the ,ccs= syntax. Detection requires checking for applications using fopen with unvalidated user-supplied mode strings containing ,ccs=. Review application source code or use static analysis tools to identify such patterns.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash programs, or gain unauthorized access to system resources. However, this usage pattern is rare in common applications.

Compliance Impact

This vulnerability could potentially lead to unauthorized data access or corruption, which may violate compliance requirements under GDPR (data protection) or HIPAA (health data security) if exploited in systems handling sensitive data.

Mitigation Strategies

Immediately update the GNU C Library to version 2.46 or later. Audit applications for fopen usage with ,ccs= and ensure mode strings are validated before passing to the function. Remove or sanitize any untrusted input in mode arguments.

Hi! I’m here to help you understand CVE-2026-18374. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70