{"id":"CVE-2026-18374","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-18374","generatedAt":"2026-10-28T08:10:45.774Z","title":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker…","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.","published":"2026-08-27T20:17:04.000Z","lastModified":"2026-09-03T16:43:15.000Z","status":"Awaiting Analysis","sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","cvss":{"version":"3.1","score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},"cwe":["CWE-787"],"affected":[],"epss":{"score":0.00144,"percentile":0.0365,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34574","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/27/6","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}