Out-of-bounds write in GNU C Library (glibc) - CVE-2026-19542

Vulnerability identifier: #VU150023

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-19542

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based out-of-bounds write in tdelete when rebalancing a sufficiently deep tree. A remote attacker can drive a large number of insertions and deletions through an application that uses tsearch and tdelete to cause a denial of service.

Triggering requires a node depth of exactly 40 or 40 plus a multiple of 20; the written value is a pointer into a tree node and is not directly attacker controlled.

GNU C Library (glibc)
openEuler
Anolis OS
glibc-help
nss_modules
nscd
libnsl
glibc-nss-devel
glibc-locale-source
glibc-devel
glibc-debugutils
glibc-debugsource
glibc-debuginfo
glibc-compat-2.17
glibc-common
glibc-benchtests
glibc-all-langpacks
glibc
glibc-locale-archive
glibc-doc
nss_hesiod
nss_db
glibc-utils
glibc-static
glibc-minimal-langpack
glibc-langpack-zh
glibc-langpack-en
glibc-gconv-extra
compat-libpthread-nonshared

Install security update from vendor's website.

GNU C Library (glibc) - update to 2.45
glibc-help - addressed in versions 2.28-131, 2.34-183
nss_modules - addressed in versions 2.28-131, 2.34-183
nscd - addressed in versions 2.28-131, 2.34-183
libnsl - addressed in versions 2.28-131, 2.34-183
glibc-nss-devel - addressed in versions 2.28-131, 2.34-183
glibc-locale-source - addressed in versions 2.28-131, 2.34-183
glibc-devel - addressed in versions 2.28-131, 2.34-183
glibc-debugutils - addressed in versions 2.28-131, 2.34-183
glibc-debugsource - addressed in versions 2.28-131, 2.34-183
glibc-debuginfo - addressed in versions 2.28-131, 2.34-183
glibc-compat-2.17 - addressed in versions 2.28-131, 2.34-183
glibc-common - addressed in versions 2.28-131, 2.34-183
glibc-benchtests - update to 2.28-131
glibc-all-langpacks - addressed in versions 2.28-131, 2.34-183
glibc - addressed in versions 2.28-131, 2.34-183
glibc-locale-archive - update to 2.34-183
glibc-doc - update to 2.38-30
nss_hesiod - update to 2.38-30
nss_db - update to 2.38-30
libnsl - update to 2.38-30
glibc-utils - update to 2.38-30
glibc-static - update to 2.38-30
glibc-nss-devel - update to 2.38-30
glibc-minimal-langpack - update to 2.38-30
glibc-locale-source - update to 2.38-30
glibc-langpack-zh - update to 2.38-30
glibc-langpack-en - update to 2.38-30
glibc-gconv-extra - update to 2.38-30
glibc-devel - update to 2.38-30
glibc-common - update to 2.38-30
glibc-benchtests - update to 2.38-30
glibc-all-langpacks - update to 2.38-30
glibc - update to 2.38-30
compat-libpthread-nonshared - update to 2.38-30

• https://www.openwall.com/lists/oss-security/2026/09/14/31
• https://sourceware.org/git/?p=glibc.git;a=commit;h=e2789c46e3bfdcd67a82bea9946b315c179e83d3

• Multiple vulnerabilities in GNU C Library (glibc)
• openEuler 22.03 LTS SP4 update for glibc
• openEuler 20.03 LTS SP4 update for glibc
• Anolis OS update for glibc