Description

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-27T20:17:03.553Z",
  "pubdate": "2026-08-27T20:17:03.553Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the GNU C Library (glibc) within the implementation of the fopen function's ',ccs=' mode extension.\nThe vulnerability occurs when an effectively empty string is passed to the ',ccs=' parameter, resulting in memory corruption.\nThis flaw affects glibc version 2.45 and earlier.\nIf an application passes user-supplied, unsanitized input directly into the fopen mode argument, an attacker may be able to trigger the heap overflow.\nSuccessful exploitation could lead to arbitrary code execution, denial of service, or application instability, depending on the heap layout and the data being overflowed.\nWhile this pattern is reportedly uncommon in standard GNU/Linux distributions, applications that dynamically construct file mode strings incorporating untrusted input are at elevated risk.\nThe vulnerability requires the application to process attacker-controlled values for the ccs syntax without proper validation prior to passing them to the glibc interface.",
  "technicalDetails": "The vulnerability lies in the internal handling of the ',ccs=' syntax extension within the fopen() function in the GNU C Library (glibc). This extension is designed to specify the character set for wide-oriented file streams.\nThe root cause is an improper bounds check or lack of input validation when processing the substring provided after the ',ccs=' specifier. When an effectively empty string is provided—for instance, when the mode argument contains ',ccs=' followed by no character set name or an improper termination—the internal parsing logic fails to handle the memory allocation for the specified character set buffer correctly.\nSpecifically, the component responsible for parsing the mode string does not adequately account for edge cases in the ',ccs=' syntax. When this logic attempts to process an empty or malformed ccs specifier, it may trigger an erroneous write operation to the heap, leading to a buffer overflow.\nThe attack flow requires an application to take user-controllable input and incorporate it into the mode string passed to fopen(). For example, if an application constructs the mode string as fopen(filename, mode_buffer), where mode_buffer contains user-supplied data, an attacker could supply a string containing ',ccs=' with no subsequent valid character set name.\nDuring execution, the glibc parsing routine consumes the mode string. Upon encountering the ',ccs=' substring, the library attempts to allocate or copy the specified character set. If the input is empty or malformed, the internal function may write past the intended boundary of the allocated buffer on the heap due to an off-by-one error or incorrect size calculation for the character set name.\nBecause this happens within the heap, the consequences are dependent on the state of the heap at the time of execution. An attacker could potentially overwrite adjacent heap chunks, including metadata, function pointers, or application data, potentially leading to arbitrary code execution or a crash leading to denial of service.\nThis vulnerability affects glibc version 2.45 and earlier. The exploitation does not require authentication or specific privilege levels if the application itself is reachable by the attacker and exposes the vulnerable function call with user-controlled parameters.\nThis is a local memory corruption issue; its network exposure is entirely dependent on the application using the vulnerable function to process network-received data or user-supplied file modes."
}