Reproducer: ``` #include <stdio.h> #include <stdlib.h> #include <string.h> int main (void) { enum { size = 1024 * 1024 }; char *blob = malloc (size); memset (blob, 'X', size); blob[size - 1] = 0; char prefix[] = "w,ccs= ,"; memcpy (blob, prefix, sizeof (prefix) - 1); FILE *f = fopen ("/tmp/glibc_ccs_poc.txt", blob); if (f != NULL) fclose (f); free (blob); return 0; } ``` an effectively empty ccs value could result in writes beyond bounds of an allocated buffer. Reported-by: AISLE in partnership with Red Hat
Created attachment 16968 [details] RHEL-214889.html Original report
The master branch has been updated by Florian Weimer <fw@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9765a538ebf8661a6e5578e01e35a3dd30db7eb4 commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4 Author: Dongkyun Son <dongkyun.s@samsung.com> Date: Fri Sep 4 21:28:41 2026 +0900 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com> Reviewed-by: Florian Weimer <fweimer@redhat.com>
The release/2.44/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0b4e41fc51e6aba6216a908961b49b0622b47fa0 commit 0b4e41fc51e6aba6216a908961b49b0622b47fa0 Author: Dongkyun Son <dongkyun.s@samsung.com> Date: Fri Sep 4 21:28:41 2026 +0900 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com> Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4)
The release/2.43/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=72351055c6a1328c1ce2c06b72b8a4e3ebe0ef08 commit 72351055c6a1328c1ce2c06b72b8a4e3ebe0ef08 Author: Dongkyun Son <dongkyun.s@samsung.com> Date: Fri Sep 4 21:28:41 2026 +0900 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com> Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4)
The release/2.42/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=2ba6f4c063e9b2d451e25e758d704f33b5d958a6 commit 2ba6f4c063e9b2d451e25e758d704f33b5d958a6 Author: Dongkyun Son <dongkyun.s@samsung.com> Date: Fri Sep 4 21:28:41 2026 +0900 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com> Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4)
The release/2.41/master branch has been updated by Aurelien Jarno <aurel32@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f806c45178dbca3be08a25cc5dd6d5542ce84a59 commit f806c45178dbca3be08a25cc5dd6d5542ce84a59 Author: Dongkyun Son <dongkyun.s@samsung.com> Date: Fri Sep 4 21:28:41 2026 +0900 libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling When fopen() is called with a ,ccs= parameter whose value becomes empty after strip(), the code must reject it with EINVAL instead of attempting to use it. The original upstr() fallback could read past the ',' delimiter and cause a heap buffer overflow. The fix checks if the charset specification is empty after strip() and returns EINVAL immediately, preventing the overflow and following the approach described in BZ #34574. CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Reported-by: AISLE in partnership with Red Hat Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com> Reviewed-by: Florian Weimer <fweimer@redhat.com> (cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4)