# The GNU C Library glibc.

Every CVE that names The GNU C Library glibc among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [BIG-HKSCS decoding hang on crafted input](https://agentprime.io/advisories/CVE-2026-122054.md)
  `CVE-2026-122054` · CVE record: The GNU C Library glibc · CVSS 5.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service
- [gettext: Directory traversal via the LANGUAGE environment variable](https://agentprime.io/advisories/CVE-2026-84243.md)
  `CVE-2026-84243` · CVE record: The GNU C Library glibc · CVSS 7.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [One-byte overread in strncasecmp on Power8](https://agentprime.io/advisories/CVE-2026-97399.md)
  `CVE-2026-97399` · CVE record: The GNU C Library glibc · CVSS 3.7 Low · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-126
- [AT_SECURE program buffer overflow via $ORIGIN processing](https://agentprime.io/advisories/CVE-2026-95818.md)
  `CVE-2026-95818` · CVE record: The GNU C Library glibc · CVSS 3.6 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [AT_SECURE programs may load attacker-controlled code via $ORIGIN](https://agentprime.io/advisories/CVE-2026-86805.md)
  `CVE-2026-86805` · CVE record: The GNU C Library glibc · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Race condition
- [Assertion failure in the DNS stub resolver with a long search domain](https://agentprime.io/advisories/CVE-2026-8674.md)
  `CVE-2026-8674` · CVE record: The GNU C Library glibc · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [EUC_JISX0213 decoding may hang on crafted input](https://agentprime.io/advisories/CVE-2026-80489.md)
  `CVE-2026-80489` · CVE record: The GNU C Library glibc · CVSS 5.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [SHIFT_JISX0213 decoding may hang on crafted input](https://agentprime.io/advisories/CVE-2026-77117.md)
  `CVE-2026-77117` · CVE record: The GNU C Library glibc · CVSS 5.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [Stack-based out-of-bounds write in tdelete during tree rebalancing](https://agentprime.io/advisories/CVE-2026-19542.md)
  `CVE-2026-19542` · CVE record: The GNU C Library glibc · CVSS 5.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Buffer overflow in strfmon and strfmon_l right-justification padding](https://agentprime.io/advisories/CVE-2026-19499.md)
  `CVE-2026-19499` · CVE record: The GNU C Library glibc · CVSS 7.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Stack overflow in nscd due to unbounded alloca use](https://agentprime.io/advisories/CVE-2026-89092.md)
  `CVE-2026-89092` · CVE record: The GNU C Library glibc · CVSS 4.2 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service
- [Out-of-bounds write in The GNU C Library glibc](https://agentprime.io/advisories/CVE-2026-18374.md)
  `CVE-2026-18374` · CVE record: The GNU C Library glibc · CVSS 4.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Memory corruption
- [Potential stack-based buffer clash during tilde expansion in wordexp](https://agentprime.io/advisories/CVE-2026-6791.md)
  `CVE-2026-6791` · CVE record: The GNU C Library glibc · CVSS 6.6 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption
- [Buffer overread in ns_printrrf with corrupted RDATA field](https://agentprime.io/advisories/CVE-2026-6238.md)
  `CVE-2026-6238` · CVE record: The GNU C Library glibc · CVSS 6.5 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-126
- [Potential buffer overflow in ns_sprintrrf TSIG handling path](https://agentprime.io/advisories/CVE-2026-5435.md)
  `CVE-2026-5435` · CVE record: The GNU C Library glibc · CVSS 7.3 High · Not analysed yet · Published 28 Apr 2026 · Tags: Memory corruption
- [scanf %mc off-by-one heap buffer overflow](https://agentprime.io/advisories/CVE-2026-5450.md)
  `CVE-2026-5450` · CVE record: The GNU C Library glibc · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: Memory corruption
- [Potential buffer under-read in ungetwc](https://agentprime.io/advisories/CVE-2026-5928.md)
  `CVE-2026-5928` · CVE record: The GNU C Library glibc · CVSS 7.5 High · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-127
- [iconv crash due to assertion failure with untrusted input](https://agentprime.io/advisories/CVE-2026-4046.md)
  `CVE-2026-4046` · CVE record: The GNU C Library glibc · CVSS 7.5 High · Not analysed yet · Published 30 Mar 2026 · Tags: Denial of service
- [gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames](https://agentprime.io/advisories/CVE-2026-4438.md)
  `CVE-2026-4438` · CVE record: The GNU C Library glibc · CVSS 5.4 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Command injection, CWE-20
- [gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response](https://agentprime.io/advisories/CVE-2026-4437.md)
  `CVE-2026-4437` · CVE record: The GNU C Library glibc · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2026 · Tags: Memory corruption
- [Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on in…](https://agentprime.io/advisories/CVE-2026-3904.md)
  `CVE-2026-3904` · CVE record: The GNU C Library glibc · CVSS 6.2 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-366
- [wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory](https://agentprime.io/advisories/CVE-2025-15281.md)
  `CVE-2025-15281` · CVE record: The GNU C Library glibc · CVSS 7.5 High · Not analysed yet · Published 20 Jan 2026 · Tags: Memory corruption
- [getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler](https://agentprime.io/advisories/CVE-2026-0915.md)
  `CVE-2026-0915` · CVE record: The GNU C Library glibc · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2026 · Tags: Memory corruption
- [Integer overflow in memalign leads to heap corruption](https://agentprime.io/advisories/CVE-2026-0861.md)
  `CVE-2026-0861` · CVE record: The GNU C Library glibc · CVSS 8.4 High · Not analysed yet · Published 14 Jan 2026 · Tags: Memory corruption
- [Double free in The GNU C Library glibc](https://agentprime.io/advisories/CVE-2025-8058.md)
  `CVE-2025-8058` · CVE record: The GNU C Library glibc · CVSS 5.9 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: Memory corruption
- [The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registe…](https://agentprime.io/advisories/CVE-2025-5745.md)
  `CVE-2025-5745` · CVE record: The GNU C Library glibc · CVSS 5.6 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: CWE-665
- [The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those register…](https://agentprime.io/advisories/CVE-2025-5702.md)
  `CVE-2025-5702` · CVE record: The GNU C Library glibc · CVSS 5.6 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: CWE-665
- [Untrusted search path in The GNU C Library glibc](https://agentprime.io/advisories/CVE-2025-4802.md)
  `CVE-2025-4802` · CVE record: The GNU C Library glibc · CVSS 7.8 High · Not analysed yet · Published 16 May 2025 · Tags: CWE-426
- [Incorrect buffer size calculation in The GNU C Library glibc](https://agentprime.io/advisories/CVE-2025-0395.md)
  `CVE-2025-0395` · CVE record: The GNU C Library glibc · CVSS 6.2 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Memory corruption
- [nscd: netgroup cache assumes NSS callback uses in-buffer strings](https://agentprime.io/advisories/CVE-2024-33602.md)
  `CVE-2024-33602` · CVE record: The GNU C Library glibc · CVSS 7.4 High · Not analysed yet · Published 6 May 2024 · Tags: CWE-466
- [nscd: netgroup cache may terminate daemon on memory allocation failure](https://agentprime.io/advisories/CVE-2024-33601.md)
  `CVE-2024-33601` · CVE record: The GNU C Library glibc · CVSS 7.3 High · Not analysed yet · Published 6 May 2024 · Tags: Denial of service
- [nscd: Null pointer crashes after notfound response](https://agentprime.io/advisories/CVE-2024-33600.md)
  `CVE-2024-33600` · CVE record: The GNU C Library glibc · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2024 · Tags: Memory corruption
- [nscd: Stack-based buffer overflow in netgroup cache](https://agentprime.io/advisories/CVE-2024-33599.md)
  `CVE-2024-33599` · CVE record: The GNU C Library glibc · CVSS 8.1 High · Not analysed yet · Published 6 May 2024 · Tags: Memory corruption
- [Out-of-bounds write in The GNU C Library glibc](https://agentprime.io/advisories/CVE-2024-2961.md)
  `CVE-2024-2961` · CVE record: The GNU C Library glibc · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.88 · Not analysed yet · Published 17 Apr 2024 · Tags: Memory corruption

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=the-gnu-c-library-glibc>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/the-gnu-c-library-glibc/>. Everything for agents: <https://agentprime.io/llms.txt>.