CVE-2017-17426

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-12-05 · updated 2026-06-17
Weakness: CWE-190

Description

The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.

Affected products

GNU C Library (glibc): 2.26

References

https://sourceware.org/bugzilla/show_bug.cgi?id=22375
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=34697694e8a93b325b18f25f7dcded55d6baeaf6
https://sourceware.org/bugzilla/show_bug.cgi?id=22375
https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=34697694e8a93b325b18f25f7dcded55d6baeaf6

Get alerted when CVE-2017-17426 or the next vulnerability affects your stack