Skip to content
Fencer Intel
critical 9.8

CVE-2026-5450 json

scanf %mc off-by-one heap buffer overflow

published 6mo ago modified 6h ago also EUVD-2026-23978

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • glibc Debian 13 2.41-12+deb13u4
  • glibc Debian 14 2.42-17

debian advisories DEBIAN-CVE-2026-5450

  • glibc Ubuntu 22.04 LTS 2.35-0ubuntu3.14
  • glibc Ubuntu 24.04 LTS 2.39-0ubuntu8.8
  • glibc Ubuntu 26.04 LTS 2.43-2ubuntu2.3

ubuntu advisories UBUNTU-CVE-2026-5450

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • glibc RHEL 9 2.34-272.el9_8
  • nscd RHEL 9 2.34-272.el9_8
  • libnsl RHEL 9 2.34-272.el9_8
  • nss_db RHEL 9 2.34-272.el9_8
  • nss_hesiod RHEL 9 2.34-272.el9_8
  • glibc-utils RHEL 9 2.34-272.el9_8
  • glibc-common RHEL 9 2.34-272.el9_8
  • glibc-benchtests RHEL 9 2.34-272.el9_8

red hat advisories RHSA-2026:37396RHSA-2026:37395RHSA-2026:36643RHSA-2026:34211RHSA-2026:33231RHSA-2026:33229

  • glibc SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 2.31-150300.101.1
  • glibc Linux Micro Extras 6.2 2.40-160000.5.1
  • glibc SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.22-114.46.1

suse advisories SUSE-SU-2026:2440-1SUSE-SU-2026:2333-1SUSE-SU-2026:21780-1

  • grype-db openSUSE Tumbleweed 0.54.4-1.1
  • glibc openSUSE Tumbleweed 2.43-3.1

opensuse advisories openSUSE-SU-2026:12059-1openSUSE-SU-2026:10770-1

  • glibc AlmaLinux 10 2.39-126.el10_2.alma.1
  • libnsl AlmaLinux 10 2.39-126.el10_2.alma.1
  • nss_db AlmaLinux 10 2.39-126.el10_2.alma.1
  • nss_hesiod AlmaLinux 10 2.39-126.el10_2.alma.1
  • glibc-utils AlmaLinux 10 2.39-126.el10_2.alma.1
  • glibc-common AlmaLinux 10 2.39-126.el10_2.alma.1
  • glibc-benchtests AlmaLinux 10 2.39-126.el10_2.alma.1
  • glibc-gconv-extra AlmaLinux 10 2.39-126.el10_2.alma.1

almalinux advisories ALSA-2026:33092ALSA-2026:33126ALSA-2026:33226

  • glibc Rocky Linux 10 2.39-126.el10_2
  • glibc Rocky Linux 9 2.34-272.el9_8
  • glibc Rocky Linux 8 2.28-251.el8_10.38

rocky linux advisories RLSA-2026:33092RLSA-2026:33226RLSA-2026:33126

Is CVE-2026-5450 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5450 updated cvss 5.0

glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width

  • Red Hat Enterprise Linux 6 compat-glibc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82888
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-trust-manager-rhel9 1790598593
    fixed: vendor fix RHSA-2026:72502
  • Red Hat Cost Management 4 costmanagement/costmanagement-metrics-rhel9-operator 1783539156
    fixed: vendor fix RHSA-2026:39981
  • Red Hat CodeReady Linux Builder EUS (v.9.6) nss_db 2.34-168.el9_6.25, nss_hesiod 2.34-168.el9_6.25, glibc-benchtests 2.34-168.el9_6.25
    fixed: vendor fix RHSA-2026:33230
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1784821750, discovery/discovery-server-rhel9 1784821670
    fixed: vendor fix RHSA-2026:46836
  • Red Hat Enterprise Linux AppStream (v. 8) glibc-utils 2.28-251.el8_10.38, compat-libpthread-nonshared 2.28-251.el8_10.38
    fixed: vendor fix RHSA-2026:33126
show 32 more
  • Red Hat Enterprise Linux AppStream (v. 9) glibc-utils 2.34-272.el9_8, glibc-locale-source 2.34-272.el9_8
    fixed: vendor fix RHSA-2026:33226
  • Red Hat Enterprise Linux AppStream (v. 10) glibc-utils 2.39-126.el10_2, glibc-locale-source 2.39-126.el10_2
    fixed: vendor fix RHSA-2026:33092
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) glibc-utils 2.28-151.el8_4.6, glibc-debuginfo-common 2.28-151.el8_4.6, compat-libpthread-nonshared 2.28-151.el8_4.6
    fixed: vendor fix RHSA-2026:36643
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) glibc-utils 2.28-189.13.el8_6, compat-libpthread-nonshared 2.28-189.13.el8_6
    fixed: vendor fix RHSA-2026:33227
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) glibc-utils 2.28-225.el8_8.17, compat-libpthread-nonshared 2.28-225.el8_8.17
    fixed: vendor fix RHSA-2026:33228
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) glibc-utils 2.34-60.el9_2.20, glibc-locale-source 2.34-60.el9_2.20
    fixed: vendor fix RHSA-2026:33231
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) glibc-utils 2.34-100.el9_4.13, glibc-locale-source 2.34-100.el9_4.13
    fixed: vendor fix RHSA-2026:33229
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) glibc-utils 2.39-46.el10_0.5, glibc-locale-source 2.39-46.el10_0.5
    fixed: vendor fix RHSA-2026:33170
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) glibc-utils 2.34-168.el9_6.25, glibc-locale-source 2.34-168.el9_6.25
    fixed: vendor fix RHSA-2026:33230
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) glibc-utils 2.28-151.el8_4.6, glibc-debuginfo-common 2.28-151.el8_4.6, compat-libpthread-nonshared 2.28-151.el8_4.6
    fixed: vendor fix RHSA-2026:36643
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) glibc-utils 2.28-189.13.el8_6, compat-libpthread-nonshared 2.28-189.13.el8_6
    fixed: vendor fix RHSA-2026:33227
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) glibc-utils 2.28-225.el8_8.17, compat-libpthread-nonshared 2.28-225.el8_8.17
    fixed: vendor fix RHSA-2026:33228
  • Red Hat Enterprise Linux BaseOS (v. 8) nscd 2.28-251.el8_10.38, glibc 2.28-251.el8_10.38, libnsl 2.28-251.el8_10.38, nss_db 2.28-251.el8_10.38, glibc-common 2.28-251.el8_10.38, glibc-gconv-extra 2.28-251.el8_10.38, +3 more
    fixed: vendor fix RHSA-2026:33126
  • Red Hat Enterprise Linux BaseOS (v. 9) nscd 2.34-272.el9_8, glibc 2.34-272.el9_8, libnsl 2.34-272.el9_8, glibc-common 2.34-272.el9_8, glibc-gconv-extra 2.34-272.el9_8, glibc-all-langpacks 2.34-272.el9_8, +1 more
    fixed: vendor fix RHSA-2026:33226
  • Red Hat Enterprise Linux BaseOS (v. 10) glibc 2.39-126.el10_2, libnsl 2.39-126.el10_2, glibc-common 2.39-126.el10_2, glibc-gconv-extra 2.39-126.el10_2, glibc-all-langpacks 2.39-126.el10_2, glibc-minimal-langpack 2.39-126.el10_2
    fixed: vendor fix RHSA-2026:33092
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) nscd 2.28-151.el8_4.6, glibc 2.28-151.el8_4.6, libnsl 2.28-151.el8_4.6, nss_db 2.28-151.el8_4.6, glibc-common 2.28-151.el8_4.6, glibc-all-langpacks 2.28-151.el8_4.6, +3 more
    fixed: vendor fix RHSA-2026:36643
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) nscd 2.28-189.13.el8_6, glibc 2.28-189.13.el8_6, libnsl 2.28-189.13.el8_6, nss_db 2.28-189.13.el8_6, glibc-common 2.28-189.13.el8_6, glibc-gconv-extra 2.28-189.13.el8_6, +3 more
    fixed: vendor fix RHSA-2026:33227
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) nscd 2.28-225.el8_8.17, glibc 2.28-225.el8_8.17, libnsl 2.28-225.el8_8.17, nss_db 2.28-225.el8_8.17, glibc-common 2.28-225.el8_8.17, glibc-gconv-extra 2.28-225.el8_8.17, +3 more
    fixed: vendor fix RHSA-2026:33228
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) nscd 2.34-60.el9_2.20, glibc 2.34-60.el9_2.20, libnsl 2.34-60.el9_2.20, glibc-common 2.34-60.el9_2.20, glibc-gconv-extra 2.34-60.el9_2.20, glibc-all-langpacks 2.34-60.el9_2.20, +1 more
    fixed: vendor fix RHSA-2026:33231
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) nscd 2.34-100.el9_4.13, glibc 2.34-100.el9_4.13, libnsl 2.34-100.el9_4.13, glibc-common 2.34-100.el9_4.13, glibc-gconv-extra 2.34-100.el9_4.13, glibc-all-langpacks 2.34-100.el9_4.13, +1 more
    fixed: vendor fix RHSA-2026:33229
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) glibc 2.39-46.el10_0.5, libnsl 2.39-46.el10_0.5, glibc-common 2.39-46.el10_0.5, glibc-gconv-extra 2.39-46.el10_0.5, glibc-all-langpacks 2.39-46.el10_0.5, glibc-minimal-langpack 2.39-46.el10_0.5
    fixed: vendor fix RHSA-2026:33170
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) nscd 2.34-168.el9_6.25, glibc 2.34-168.el9_6.25, libnsl 2.34-168.el9_6.25, glibc-common 2.34-168.el9_6.25, glibc-gconv-extra 2.34-168.el9_6.25, glibc-all-langpacks 2.34-168.el9_6.25, +1 more
    fixed: vendor fix RHSA-2026:33230
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) nscd 2.28-151.el8_4.6, glibc 2.28-151.el8_4.6, libnsl 2.28-151.el8_4.6, nss_db 2.28-151.el8_4.6, glibc-common 2.28-151.el8_4.6, glibc-all-langpacks 2.28-151.el8_4.6, +3 more
    fixed: vendor fix RHSA-2026:36643
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) nscd 2.28-189.13.el8_6, glibc 2.28-189.13.el8_6, libnsl 2.28-189.13.el8_6, nss_db 2.28-189.13.el8_6, glibc-common 2.28-189.13.el8_6, glibc-gconv-extra 2.28-189.13.el8_6, +3 more
    fixed: vendor fix RHSA-2026:33227
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) nscd 2.28-225.el8_8.17, glibc 2.28-225.el8_8.17, libnsl 2.28-225.el8_8.17, nss_db 2.28-225.el8_8.17, glibc-common 2.28-225.el8_8.17, glibc-gconv-extra 2.28-225.el8_8.17, +3 more
    fixed: vendor fix RHSA-2026:33228
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nss_db 2.34-272.el9_8, nss_hesiod 2.34-272.el9_8, glibc-benchtests 2.34-272.el9_8
    fixed: vendor fix RHSA-2026:33226
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) nss_db 2.39-126.el10_2, nss_hesiod 2.39-126.el10_2, glibc-benchtests 2.39-126.el10_2
    fixed: vendor fix RHSA-2026:33092
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) nss_db 2.39-46.el10_0.5, nss_hesiod 2.39-46.el10_0.5, glibc-benchtests 2.39-46.el10_0.5
    fixed: vendor fix RHSA-2026:33170
  • Red Hat Enterprise Linux CRB (v. 8) nss_hesiod 2.28-251.el8_10.38, glibc-benchtests 2.28-251.el8_10.38
    fixed: vendor fix RHSA-2026:33126
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) nscd 2.12-1.212.el6_10.4, glibc 2.12-1.212.el6_10.4, glibc-utils 2.12-1.212.el6_10.4, glibc-common 2.12-1.212.el6_10.4, glibc-debuginfo-common 2.12-1.212.el6_10.4
    fixed: vendor fix RHSA-2026:37395
  • Red Hat Enterprise Linux Server (v. 7 ELS) nscd 2.17-326.el7_9.6, glibc 2.17-326.el7_9.6, compat-glibc 2.12-4.el7_9.1, glibc-utils 2.17-326.el7_9.6, glibc-common 2.17-326.el7_9.6, glibc-debuginfo-common 2.17-326.el7_9.6
    fixed: vendor fix RHSA-2026:37396
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) glibc-debuginfo-common 2.12-1.212.el6_10.4
    fixed: vendor fix RHSA-2026:37395

14 more fixed, 5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
6mo ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • sourceware.org https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • The GNU C Library glibc
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.