CVE-2026-18374: The GNU C Library Glibc

Medium severity, CVSS 4.9. EPSS: 0.1% chance of exploitation in the next 30 days.

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

Affected products

Published 2026-08-27. Last modified 2026-09-03.