Bug 2526300 - CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen mode string [epel-all]
Summary: CVE-2026-18374 zig: glibc: Heap buffer overflow via attacker-controlled fopen...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: zig
Version: epel10
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Jan Drögehoff
QA Contact:
URL:
Whiteboard: {"flaws": ["7dfb1b13-46a5-4d39-933c-7...
Depends On:
Blocks: CVE-2026-18374
TreeView+ depends on / blocked
 
Reported: 2026-08-31 14:05 UTC by Ganesh
Modified: 2026-09-01 07:14 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-09-01 07:14:03 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Ganesh 2026-08-31 14:05:16 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.



This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

Comment 1 Renich Bon Ciric 2026-09-01 07:14:03 UTC
Zig is not affected by this vulnerability.

While `zig.spec` declares `Provides: bundled(glibc) = 2.43` to account for embedded headers and ABI symbol metadata, Zig does not bundle or compile the GNU C Library implementation of `fopen` (or `libio` where the `,ccs=` parsing flaw resides).

Specifically:
- Zig only ships glibc ABI symbol tables (`abilists`) to generate compile-time dynamic linking stubs (`.so`), generic headers, and minimal C runtime startup objects (`crt1.o`, `elf-init`, `stat` shims).
- Zig compiler binaries and generated executables dynamically link against the host/target system's runtime `libc.so.6`.

Closing as NOTABUG.


Note You need to log in before you can comment on or make changes to this bug.