Infinite loop in GNU C Library (glibc) - CVE-2026-77117

Vulnerability identifier: #VU150024

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-77117

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to failure to clear a pending character in the SHIFT_JISX0213 converter when converting crafted input with an output buffer that splits a two-code-point sequence. A remote attacker can supply crafted SHIFT_JISX0213 input to cause a denial of service.

Only the SHIFT_JISX0213 character set is affected.

GNU C Library (glibc)
openEuler
glibc-help
glibc
glibc-all-langpacks
glibc-benchtests
glibc-common
glibc-compat-2.17
glibc-debuginfo
glibc-debugsource
glibc-devel
glibc-locale-source
glibc-nss-devel
libnsl
nscd
nss_modules
glibc-debugutils
glibc-locale-archive

Install security update from vendor's website.

GNU C Library (glibc) - update to 2.45
glibc-help - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-all-langpacks - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-benchtests - update to 2.28-131
glibc-common - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-compat-2.17 - addressed in versions 2.28-131, 2.34-183
glibc-debuginfo - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-debugsource - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-devel - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-locale-source - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-nss-devel - addressed in versions 2.28-131, 2.34-183, 2.38-124
libnsl - addressed in versions 2.28-131, 2.34-183, 2.38-124
nscd - addressed in versions 2.28-131, 2.34-183, 2.38-124
nss_modules - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-debugutils - addressed in versions 2.28-131, 2.34-183, 2.38-124
glibc-locale-archive - addressed in versions 2.34-183, 2.38-124

• https://www.openwall.com/lists/oss-security/2026/09/14/31
• https://sourceware.org/git/?p=glibc.git;a=commit;h=68d94bbe50b7577d48998107d632ef3a0df050e3

• Multiple vulnerabilities in GNU C Library
• openEuler 24.03 LTS SP3 update for glibc
• openEuler 24.03 LTS SP1 update for glibc
• openEuler 22.03 LTS SP4 update for glibc
• openEuler 20.03 LTS SP4 update for glibc