CVE-2026-0861

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0861", "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "state": "PUBLISHED", "assignerShortName": "glibc", "dateReserved": "2026-01-12T14:35:11.285Z", "datePublished": "2026-01-14T21:01:11.037Z", "dateUpdated": "2026-04-29T13:28:15.670Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "glibc", "vendor": "The GNU C Library", "versions": [{"lessThanOrEqual": "2.42", "status": "affected", "version": "2.30", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern, Aisle Research"}], "datePublic": "2026-01-14T05:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.<br><br>Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1&lt;&lt;62+ 1, 1&lt;&lt;63] and exactly 1&lt;&lt;63 for posix_memalign and aligned_alloc.<br><br>Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."}], "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129 Pointer Manipulation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "shortName": "glibc", "dateUpdated": "2026-01-16T14:37:33.544Z"}, "references": [{"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796"}, {"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001"}], "source": {"discovery": "UNKNOWN"}, "title": "Integer overflow in memalign leads to heap corruption", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T03:55:55.254366Z", "id": "CVE-2026-0861", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:28:15.670Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/16/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-16T17:06:42.010Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/16/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-16T17:06:42.010Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-29T03:55:55.254366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T21:25:28.506Z"}}], "cna": {"title": "Integer overflow in memalign leads to heap corruption", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern, Aisle Research"}], "impacts": [{"capecId": "CAPEC-129", "descriptions": [{"lang": "en", "value": "CAPEC-129 Pointer Manipulation"}]}], "affected": [{"vendor": "The GNU C Library", "product": "glibc", "versions": [{"status": "affected", "version": "2.30", "versionType": "custom", "lessThanOrEqual": "2.42"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-14T05:00:00.000Z", "references": [{"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796"}, {"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.", "supportingMedia": [{"type": "text/html", "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.<br><br>Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1&lt;&lt;62+ 1, 1&lt;&lt;63] and exactly 1&lt;&lt;63 for posix_memalign and aligned_alloc.<br><br>Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "shortName": "glibc", "dateUpdated": "2026-01-16T14:37:33.544Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0861", "state": "PUBLISHED", "dateUpdated": "2026-04-29T13:28:15.670Z", "dateReserved": "2026-01-12T14:35:11.285Z", "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "datePublished": "2026-01-14T21:01:11.037Z", "assignerShortName": "glibc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "glibc", "vendor": "The GNU C Library", "versions": [{"lessThanOrEqual": "2.42", "status": "affected", "version": "2.30", "versionType": "custom"}]}], "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*", "matchCriteriaId": "695F54F4-F00E-4777-BFA3-CA09D169D050", "versionEndIncluding": "2.42", "versionStartIncluding": "2.30", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."}, {"lang": "es", "value": "Pasar una alineaci\u00f3n demasiado grande a la suite de funciones memalign (memalign, posix_memalign, aligned_alloc) en la biblioteca C de GNU versi\u00f3n 2.30 a 2.42 puede resultar en un desbordamiento de entero, lo que podr\u00eda consecuentemente resultar en una corrupci\u00f3n de mont\u00f3n.\n\nTenga en cuenta que el atacante debe tener control sobre ambos, los argumentos de tama\u00f1o y de alineaci\u00f3n de la funci\u00f3n memalign para poder explotar esto. El par\u00e1metro de tama\u00f1o debe estar lo suficientemente cerca de PTRDIFF_MAX como para desbordar size_t junto con el argumento de alineaci\u00f3n grande. Esto limita las entradas maliciosas para la alineaci\u00f3n para memalign al rango [1&lt;&lt;62+ 1, 1&lt;&lt;63] y exactamente 1&lt;&lt;63 para posix_memalign y aligned_alloc.\n\nT\u00edpicamente, el argumento de alineaci\u00f3n pasado a tales funciones es una cantidad restringida conocida (p. ej., tama\u00f1o de p\u00e1gina, tama\u00f1o de bloque, tama\u00f1os de estructura) y no est\u00e1 controlado por el atacante, por lo cual esto podr\u00eda no ser f\u00e1cilmente explotable en la pr\u00e1ctica. Un error de aplicaci\u00f3n podr\u00eda potencialmente resultar en que la alineaci\u00f3n de entrada sea demasiado grande, p. ej., debido a un desbordamiento de b\u00fafer diferente o un desbordamiento de entero en la aplicaci\u00f3n o sus bibliotecas dependientes, pero ese es de nuevo un patr\u00f3n de uso poco com\u00fan dadas las fuentes t\u00edpicas de alineaciones."}], "id": "CVE-2026-0861", "lastModified": "2026-06-17T10:11:31.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0861", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T03:55:55.254366Z", "version": "2.0.3"}}]}, "published": "2026-01-14T21:15:52.617", "references": [{"source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "tags": ["Exploit"], "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796"}, {"source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "tags": ["Patch"], "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5"}], "sourceIdentifier": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18", "type": "Secondary"}]}

{"bugzilla": {"description": "glibc: Integer overflow in memalign leads to heap corruption", "id": "2429771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429771"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.", "A flaw was found in the glibc library. Passing an excessively large alignment value to the memalign suite of functions, such as memalign, posix_memalign, aligned_alloc, valloc and pvalloc, an integer overflow can occur during internal size calculations due to improper overflow checks, causing an allocation of a small chunk of memory which is subsequently used for writing. This issue can result in an application crash or heap memory corruption."], "mitigation": {"lang": "en:us", "value": "Applications calling one of the vulnerable functions and allowing the alignment parameter to be set by user-controlled input can implement additional validations checks, ensuring the alignment value is a power of two and does not exceed a sane limit, for example the system page size or a maximum of 64KB. This prevents the excessively large value required to trigger the integer overflow."}, "name": "CVE-2026-0861", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "compat-glibc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "compat-glibc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "glibc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-01-14T21:01:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-0861\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-0861\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=33796"], "statement": "To exploit this flaw, an attacker needs to find an application linked to the glibc library that is using one of the vulnerable functions (memalign, posix_memalign, aligned_alloc, valloc or pvalloc) in a way that the alignment parameter can be user-controlled, allowing an attacker to trigger the integer overflow. However, the alignment parameter used by the functions is usually hard-coded power of two and do not allow arbitrary values, specially values supplied by a user.\nAlso, default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and memory protections significantly increase the difficult of achieving arbitrary code execution, limiting the impact of this vulnerability.\nDue to these reasons, this vulnerability has been rated with an important severity.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T06:13:39.341596+00:00", "value": {"mitigation_remediation": ["Upgrade the system to glibc 2.43 or later, which contains the fix for this integer overflow", "Audit application code to ensure that calls to memalign, posix_memalign, or aligned_alloc do not supply alignment values outside the typical range of a page size or structural alignment", "If an upgrade is not immediately possible, add defensive checks to sanitize or clamp alignment inputs before they reach the glibc routines, and consider static analysis tools that flag suspicious alignment usage"], "summary": {"action": "Apply Patch", "impact": "Heap Corruption"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the GNU C Library (glibc) for all platforms that rely on the vulnerable 2.30\u20132.42 releases. An application using these libc versions on any operating system that links to them is potentially exposed.", "description_and_impact": "An integer overflow occurs when the memalign family of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 through 2.42 receive an alignment argument that is too large. The overflow corrupts the heap, which can lead to arbitrary memory corruption. The weakness is a classic numeric value error (CWE\u2011190).", "risk_and_exploitability": "The CVSS score of 8.4 classifies this flaw as high severity. However, the EPSS score of less than 1% and the fact that the flaw is not listed in the CISA KEV catalog suggest that it is unlikely to be widely exploited in the near term. Exploitation requires the attacker to control both the size and alignment parameters of a memalign call, a scenario that is uncommon because alignment values are typically constrained by the application or system. An attacker would also need to trigger a prior vulnerability to supply a large alignment value. Consequently, while the impact should be treated seriously, the practical risk for most deployments remains moderate."}}}}, "created": "2026-01-15T08:03:18.503026+00:00", "updated": "2026-04-18T06:15:15.875630+00:00", "vendors": ["gnu", "gnu$PRODUCT$glibc"]}