GNU C Library up to 2.43 Unicode Character libio/wgenops.c _IO_wdefault_pbackfail buffer under-read

Summaryinfo

A vulnerability described as problematic has been identified in GNU C Library up to 2.43. Affected by this issue is the function _IO_wdefault_pbackfail of the file libio/wgenops.c of the component Unicode Character Handler. Such manipulation leads to buffer under-read. This vulnerability is referenced as CVE-2026-5928. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in GNU C Library up to 2.43. It has been rated as problematic. Affected by this issue is the function _IO_wdefault_pbackfail of the file libio/wgenops.c of the component Unicode Character Handler. The manipulation with an unknown input leads to a buffer under-read vulnerability. Using CWE to declare the problem leads to CWE-127. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.

The weakness was published by Rocket Ma. The advisory is available at sourceware.org. This vulnerability is handled as CVE-2026-5928 since 04/09/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 308161 (Linux Distros Unpatched Vulnerability : CVE-2026-5928), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (308161) and CERT Bund (WID-SEC-2026-1190). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source GNU libc

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion