CVE-2026-19542
Received Received - Intake

Buffer Overflow in GNU C Library tdelete Function

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GNU C Library

Description
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-19542
EUVD
EUVD-2026-77685

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu gnu_c_library From 2.1 (inc) to 2.44 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the GNU C Library's tdelete function. When called on a deep tree structure, it may write past the end of an alloca-allocated stack array. The issue occurs because the function's rebalancing logic pushes extra entries without checking stack capacity, leading to a buffer overflow when the stack is full.

Detection Guidance

This vulnerability requires a very specific condition: a tree with at least a million nodes where nodes are inserted and deleted in a pattern that reaches a depth of exactly 40 or 40 plus a multiple of 20. Detection would involve monitoring applications using tsearch and tdelete functions for unusual memory access patterns or crashes during tree operations. No direct commands are provided for detection as the conditions are highly specific and unlikely to occur in normal operations.

Impact Analysis

An attacker could exploit this to crash an application using tsearch and tdelete functions. The vulnerability requires a very deep tree (over a million nodes) and precise conditions, making exploitation difficult. It may lead to denial-of-service but does not allow direct code execution.

Compliance Impact

This vulnerability could impact compliance by causing application crashes, potentially leading to data processing disruptions. GDPR requires secure processing of personal data, and HIPAA demands availability of healthcare systems. A crash could violate availability requirements, though no direct data exposure is indicated.

Mitigation Strategies

Update the GNU C Library to version 2.45 or later, where this issue is resolved. If updating is not immediately possible, restrict access to applications using tsearch and tdelete functions to reduce exposure. Monitor applications for crashes or memory corruption during tree operations as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart