Multiple vulnerabilities in GNU C Library (glibc) include a high-severity heap buffer overflow in scanf functions (CVE-2026-5450) and a high-severity flaw in DNS functions (CVE-2026-4437, CVSS 7.5) affecting glibc versions 2.34 through 2.43, which could lead to denial of service, arbitrary code execution, or information disclosure. The iconv function (CVE-2026-4046, CVSS 7.5) is also vulnerable in glibc versions up to and including 2.43. The article advises applying relevant distribution-specific security updates but does not specify a fixed version number.
It was discovered that the GNU C Library iconv function incorrectly handled certain IBM character sets. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-4046) It was discovered that the GNU C Library DNS functions incorrectly handled certain DNS server responses when using gethostbyaddr or gethostbyaddr_r. An attacker in a privileged network position could possibly use this issue to cause an application to violate DNS specification or obtain incorrect hostname information. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-4437, CVE-2026-4438) It was discovered that the GNU C Library deprecated debugging functions incorrectly enforced caller-supplied buffer lengths. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5435) It was discovered that the GNU C Library scanf family of functions contained a heap buffer overflow when processing certain format specifiers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5450) It was discovered that the GNU C Library ungetwc function incorrectly handled certain character encodings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-5928) It was discovered that the GNU C Library deprecated debugging functions incorrectly validated DNS response record data. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-6238)