IT SBIT Services
Schneeberger
DEEN
CVE tracker

GNU C Library: One-byte buffer overflow in wide scanf %s and %[ conversions

CVE-2026-115819Medium 4.8

← All vulnerabilities

Summary

The wide scanf functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf, vwscanf) in glibc 2.2 to 2.44 write an extra null byte one past the end of the destination when a %s or %[ conversion without the 'l' modifier stores a multibyte string that exactly fills a char array. An attacker who controls the input can trigger this off-by-one write, which may corrupt adjacent data or crash the process. The conditions are narrow: the application must store wide scanf conversions into narrow char arrays and process untrusted input.

Affected

  • GNU C Library (glibc) 2.2 through 2.44 according to the CVE record
  • Affects all architectures and ABIs supported by glibc
  • Not affected: narrow scanf functions, %ls and %l[ conversions into wchar_t arrays, 'a' and 'm' allocation modifiers

Fixed in

Unknown. No fixed version has been confirmed by the vendor advisory at the time of writing.

Workaround

  • Avoid wide scanf %s or %[ conversions without the 'l' modifier on untrusted input
  • Use input validation or alternative input handling in affected applications
  • For software you maintain, provide destination buffer space beyond the converted length

Exploitation

  • No public proof of concept known at the time of writing
  • Not listed in the CISA KEV catalog
  • EPSS score not yet available

Our recommendation

  • Apply glibc updates from your operating system vendor as soon as a fix for this CVE is published
  • Check whether your in-house or third-party software uses wide scanf %s or %[ on untrusted input
  • Monitor the vendor advisory and your distribution's security announcements for this CVE
  • Rebuild software against a patched glibc when a fix is available

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:43.

Original description (NVD)

Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array. These conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination. The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed