GNU C Library
First CVE: Apr 17, 2024Active for: 2 years
21
CVEs Published
More CVEs Published than 41% of tracked CNAs
7.0
Avg CVEs / Year
More Avg CVEs / Year than 42% of tracked CNAs
7.1
Avg CVSS Score
Higher Avg CVSS Score than 47% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Trends Over Time
The number and severity of CVEs published by GNU C Library over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 17, 2024
2 years ago
Most Recent CVE
Apr 28, 2026
88 days ago
Top CVEs
All CVEs published by GNU C Library as a CNA, regardless of affected vendor or product.
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-2961HIGH The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT charac | Apr 17, 2024 | 7.3 | 87 | NO | YES |
CVE-2026-5450CRITICAL Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width gr | Apr 20, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-5435HIGH The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an ou | Apr 28, 2026 | 7.3 | 32 | NO | NO |
CVE-2026-6238MEDIUM The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a D | Apr 28, 2026 | 6.5 | 31 | NO | NO |
CVE-2026-4046HIGH The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which m | Mar 30, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-4437HIGH Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a cr | Mar 20, 2026 | 7.5 | 31 | NO | NO |
CVE-2026-0861HIGH Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overf | Jan 14, 2026 | 8.4 | 30 | NO | NO |
CVE-2026-5928HIGH Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the G | Apr 20, 2026 | 7.5 | 29 | NO | NO |
CVE-2025-15281HIGH Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wo | Jan 20, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-0915HIGH Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Libr | Jan 15, 2026 | 7.5 | 29 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA21 CVEs
38%
57%
Severity distribution among all CVEs352,427 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local6 (28.6%)
Network14 (66.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (4.8%)
Attack Complexity
Low15 (71.4%)
High6 (28.6%)
Unknown0 (0.0%)
User Interaction
None19 (90.5%)
Unknown0 (0.0%)
Required1 (4.8%)
Privileges Required
Low1 (4.8%)
High0 (0.0%)
None20 (95.2%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (21 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
4.8% of CVEs· 96th percentile
Nuclei
1 CVE
4.8% of CVEs· 92nd percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by GNU C Library as a CNA.
Media Mentions
Media articles that mention a CVE ID published by GNU C Library as a CNA — matched by CVE ID, not by organization name.