CVE-2026-18374 Memory corruption in glibc
Heap buffer overflow in glibc fopen allows code execution or denial of service when attacker-controlled mode strings are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18374?
CVE-2026-18374 is a medium-severity memory corruption vulnerability in The GNU C Library glibc, published on 27 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Weakness: CWE-787
Which versions are affected by CVE-2026-18374?
Linux distribution packages (40)
compat-libpthread-nonshared Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-all-langpacks Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-benchtests Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-common Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-devel Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-doc Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-gconv-extra Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-aa Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-af Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-agr Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ak Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-am Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-an Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-anp Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ar Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-as Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ast Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ayc Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-az Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-be Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bem Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ber Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bg Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bhb Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bho Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bi Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bn Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bo Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-br Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-brx Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-bs Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-byn Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ca Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ce Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-chr Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-ckb Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-cmn Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-crh Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
glibc-langpack-cs Red Hat:hummingbird:1 | All versions | 0:2.43-8.5.hum1 |
How do I fix CVE-2026-18374?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-18374 being exploited?
There is no known exploitation of CVE-2026-18374 in the wild and no public exploit code.
Sources
Also known as AZL-98042, BELL-CVE-2026-18374, DEBIAN-CVE-2026-18374, ECHO-9169-1fd9-0c1c, GHSA-qg52-8pr2-xj9v, OESA-2026-3793 and 5 more.