CVE-2026-5450: gnu glibc Out-of-bounds Write

Vulnerability summary

CVE-2026-5450 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in gnu glibc. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-04-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().