VulnSocial

CVE-2026-5450Disclosure(gnu / glibc)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch gnu glibc systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.

gnu CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-122CWE-787

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • glibc

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-04-21); latest day: 1
  • 5 total mentions across 4 days

Affected systems

Vendors
gnu
Products
glibc

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-04-20: 1Mentions · 2026-04-21: 2Mentions · 2026-04-28: 1Mentions · 2026-05-08: 1PoC Mentioned / Linked · 2026-05-08: 1Exploit Tool / Code · 2026-05-08: 1Patch / Workaround · 2026-04-21: 1Patch / Workaround · 2026-04-28: 1Technical Details · 2026-04-20: 1Technical Details · 2026-04-21: 2Technical Details · 2026-04-28: 104-2004-2104-2805-08
Signal classification3 categories
Disclosure
360.0%
Patch
120.0%
PoC
120.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-201
Disclosure1
2026-04-212
Disclosure1Patch1
2026-04-281
Disclosure1
2026-05-081
PoC1
Full discourse5 posts
  • Gray Hats@the_yellow_fall
    Patch

    glibc version 2.43 and older face heap overflows and memory leaks. Learn about CVE-2026-5358, CVE-2026-5450, and CVE-2026-5928. Update your Linux systems now. #glibc #LinuxSecurity #CyberSecurity #InfoSec #OpenSource #CVE #Vulnerability #SysAdmin https://securityonline.info/glibc-vulnerabilities-2026-linux-security-flaws/ https://t.co/RnpzeVqzJk

    Post summary

    The tweet warns that glibc 2.43 and older versions have heap overflow and memory leak flaws (CVE-2026-5358, CVE-2026-5450, CVE-2026-5928) and urges users to update their systems.

    22081787
    12.5K followersView on X
  • Open Source Security mailing list@oss_security
    Disclosure

    3 new glibc SAs https://www.openwall.com/lists/oss-security/2026/04/20/9 GLIBC-SA-2026-0008,CVE-2026-5358: Static buffer overflow in deprecated nis_local_principal GLIBC-SA-2026-0009,CVE-2026-5450: scanf %mc off-by-one heap buffer overflow GLIBC-SA-2026-0010,CVE-2026-5928: Potential buffer under-read in ungetwc

    Post summary

    Three new glibc security advisories are announced, detailing three distinct buffer handling vulnerabilities.

    00040399
    4.7K followersView on X
  • Bo Shang@erolunar
    PoC

    scared? @grok 43 files changed, 1678 insertions(+), 1 deletion(-) create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/README.md create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/crashes/.analysis-note create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/diff/patch-analysis.txt create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/disclosure.md create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/harness/.analysis-note create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/intel/sources.md create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/triage/.analysis-note create mode 100644 findings/CVE-2025-14174-WEBKIT/README.md create mode 100644 findings/CVE-2025-14174-WEBKIT/crashes/.analysis-note create mode 100644 findings/CVE-2025-14174-WEBKIT/diff/patch-analysis.txt create mode 100644 findings/CVE-2025-14174-WEBKIT/disclosure.md create mode 100644 findings/CVE-2025-14174-WEBKIT/harness/.analysis-note create mode 100644 findings/CVE-2025-14174-WEBKIT/intel/sources.md create mode 100644 findings/CVE-2025-14174-WEBKIT/triage/.analysis-note create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/README.md create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/crashes/vuln-db-analysis.txt create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/diff/patch-analysis.txt create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/disclosure.md create mode 100755 findings/CVE-2025-15467-OPENSSL-CMS/harness/poc-der-craft.py create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/intel/sources.md create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/triage/.analysis-note create mode 100644 findings/CVE-2026-31431-COPYFAIL/README.md create mode 100644 findings/CVE-2026-31431-COPYFAIL/crashes/variant-verification.txt create mode 100644 findings/CVE-2026-31431-COPYFAIL/diff/patch-analysis.txt create mode 100644 findings/CVE-2026-31431-COPYFAIL/disclosure.md create mode 100755 findings/CVE-2026-31431-COPYFAIL/harness/variant-checker.py create mode 100644 findings/CVE-2026-31431-COPYFAIL/intel/sources.md create mode 100644 findings/CVE-2026-31431-COPYFAIL/triage/.analysis-note create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/README.md create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/asan-log.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/seeds/seed1.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/seeds/seed2.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/seeds/seed3.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/diff/bug-locations.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/diff/patch-v6.diff create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/diff/variant-analysis.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/disclosure.md create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/harness/fuzz-harness.c create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/harness/poc-reproducer.c create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/intel/sources.md create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/triage/gdb-triage.txt

    Post summary

    The commit introduces proof‑of‑concept scripts and harnesses for several CVEs, indicating demonstrable exploit capabilities, but does not report active real‑world exploitation, provide patches, or elaborate on technical details.

    10000513
    8 followersView on X
  • Vito Botta@vitobotta
    Disclosure

    Just read about three recent CVEs in glibc, the library that underpins basically every Linux system on the planet. The scariest one is CVE-2026-5450, a heap buffer overflow in scanf with the %mc format specifier, CVSS 9.8. Versions 2.7 through 2.43 are affected. That's decades of glibc releases. Then there's CVE-2026-5358, a buffer overflow in the obsolete nis_local_principal function, and CVE-2026-5928, a buffer under-read in ungetwc that can leak heap data. Patch your systems. When glibc has bugs, we can assume that everything built on top of it has potential bugs.

    Post summary

    The post discloses three severe glibc CVEs, details their technical nature and affected versions, and urges users to patch.

    0000092
    956 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-5450 Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an expli… https://www.cve.org/CVERecord?id=CVE-2026-5450

    Post summary

    The post provides a brief technical disclosure of a format string vulnerability in GNU C Library involving the %mc specifier, but does not mention any PoC, exploit code, patch, or active exploitation.

    0000092
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgnuglibc---

Explore more

Back to dashboardgnu CVEsglibc vulnerabilities