CVE-2026-5450
Published: 20 April 2026
Summary
CVE-2026-5450 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Gnu Glibc. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-5450 is a heap buffer overflow vulnerability affecting the GNU C Library (glibc) versions 2.7 through 2.43. The issue arises when calling functions in the scanf family with the %mc format specifier, which denotes a malloc'd character match, combined with an explicit width greater than 1024. This triggers a one-byte heap buffer overflow, associated with CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The vulnerability was published on 2026-04-20.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, stemming from the heap buffer overflow.
Mitigation details and patches are documented in advisories linked from the following references: https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u and https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23978
Vulnerability details
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte…
more
heap buffer overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote heap buffer overflow in glibc triggered via scanf input enables exploitation of public-facing applications over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly mitigates the heap buffer overflow in glibc by applying vendor patches referenced in the CVE advisories.
Vulnerability scanning identifies systems running vulnerable glibc versions 2.7 through 2.43 affected by this scanf heap overflow.
Memory protection controls like ASLR and heap hardening reduce the exploitability of the one-byte heap buffer overflow.