What’s Vulnerable › Products

GNU C Library (glibc) vulnerabilities

176 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.

Check whether your GNU C Library (glibc) version is affected

Exploited GNU C Library (glibc) vulnerabilities

• CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability

Latest GNU C Library (glibc) vulnerabilities

• CVE-2026-97399 — One-byte overread in strncasecmp on Power8 (CVSS 3.7)
• CVE-2026-95818 — AT_SECURE program buffer overflow via $ORIGIN processing (CVSS 3.6)
• CVE-2026-86805 — AT_SECURE programs may load attacker-controlled code via $ORIGIN (CVSS 6.3)
• CVE-2026-8674 — Assertion failure in the DNS stub resolver with a long search domain (CVSS 5.3)
• CVE-2026-80489 — EUC_JISX0213 decoding may hang on crafted input (CVSS 5.9)
• CVE-2026-77117 — SHIFT_JISX0213 decoding may hang on crafted input (CVSS 5.9)
• CVE-2026-19542 — Stack-based out-of-bounds write in tdelete during tree rebalancing (CVSS 5.6)
• CVE-2026-19499 — Buffer overflow in strfmon and strfmon_l right-justification padding (CVSS 7.7)
• CVE-2026-89092 — Stack overflow in nscd due to unbounded alloca use (CVSS 4.2)
• CVE-2026-18374 — (CVSS 4.9)
• CVE-2026-6791 — Potential stack-based buffer clash during tilde expansion in wordexp (CVSS 6.6)
• CVE-2026-6238 — Buffer overread in ns_printrrf with corrupted RDATA field (CVSS 6.5)
• CVE-2026-5435 — Potential buffer overflow in ns_sprintrrf TSIG handling path (CVSS 7.3)
• CVE-2026-5928 — Potential buffer under-read in ungetwc (CVSS 7.5)
• CVE-2026-5450 — scanf %mc off-by-one heap buffer overflow (CVSS 9.8)
• CVE-2026-4046 — iconv crash due to assertion failure with untrusted input (CVSS 7.5)
• CVE-2026-4438 — gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames (CVSS 5.4)
• CVE-2026-4437 — gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response (CVSS 7.5)
• CVE-2026-3904 — (CVSS 6.2)
• CVE-2025-15281 — wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVSS 7.5)
• CVE-2026-0915 — getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler (CVSS 7.5)
• CVE-2026-0861 — Integer overflow in memalign leads to heap corruption (CVSS 8.4)
• CVE-2025-8058 — (CVSS 5.9)
• CVE-2025-5745 — (CVSS 5.6)
• CVE-2025-5702 — (CVSS 5.6)