glibc 2.2–2.44 wide scanf writes one byte past buffer
Original title: The GNU C Library security advisories update for 2026-11-11
GLIBC-SA-2026-0027 says %s and %[ without the l modifier add an extra null in wide scanf conversions.
The GNU C Library published GLIBC-SA-2026-0027 on November 11. In versions 2.2 through 2.44, wide scanf functions using %s or %[ without the l length modifier write one extra null byte past the destination buffer. The snippet does not name a fix or say whether the flaw is exploited.
Unconfirmed: The feed snippet is cut off and does not state a fixed version or exploitation status.
- Affected calls include swscanf, fwscanf, wscanf and their v* variants.
- The overflow is one null byte beyond the destination.
- The posted range is GNU C Library 2.2 through 2.44.
Impact: one-byte write past a destination buffer
| Product | Affected |
|---|---|
| GNU C Library | 2.2 to 2.44 |
- Vendors
- GNU
- Products
- GNU C Library
From the original article
Posted by Adhemerval Zanella Netto on Nov 11 The following security advisories have been published: GLIBC-SA-2026-0027: =================== scanf %s and %[ one-byte buffer overflow in wide character conversion Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2. 2 to version 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.