CVE-2026-5450

BRIEFING NOTE - CVE-2026-5450 OVERVIEW A heap buffer overflow vulnerability exists in the GNU C Library versions 2.7 through 2.43 affecting the scanf family of functions. The flaw occurs when the %mc (malloc'd character match) format specifier is used with an explicit width greater than 1024 characters, potentially allowing a one-byte heap buffer overflow. This vulnerability impacts all systems running the affected glibc versions, which are ubiquitous across Linux distributions and embedded systems. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL with a network-based attack vector requiring no privileges or user interaction. Exploitation is straightforward due to low attack complexity, and successful attacks can result in full system compromise including confidential information disclosure, data integrity violations, and denial of service. The vulnerability ranks higher in severity than 99.87% of all documented CVEs. EXPLOITATION STATUS While the vulnerability is currently marked as Active on the Hot List, it is not yet listed on the Known Exploited Vulnerabilities catalog and public exploit code availability remains limited. However, the high CVSS score, straightforward attack conditions, and active listing indicate significant community attention and potential for rapid exploitation development. Organizations should prioritize patching efforts immediately given the critical severity and the likelihood of exploitation attempts.