CVE-2026-0861

{
  "id": "CVE-2026-0861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-29T03:55:55.254366Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
      "affectedData": [
        {
          "vendor": "The GNU C Library",
          "product": "glibc",
          "versions": [
            {
              "status": "affected",
              "version": "2.30",
              "versionType": "custom",
              "lessThanOrEqual": "2.42"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-14T21:15:52.617",
  "references": [
    {
      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796",
      "tags": [
        "Exploit"
      ],
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
    },
    {
      "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001",
      "tags": [
        "Patch"
      ],
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5",
      "tags": [
        "Mailing List",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."
    },
    {
      "lang": "es",
      "value": "Pasar una alineación demasiado grande a la suite de funciones memalign (memalign, posix_memalign, aligned_alloc) en la biblioteca C de GNU versión 2.30 a 2.42 puede resultar en un desbordamiento de entero, lo que podría consecuentemente resultar en una corrupción de montón.\n\nTenga en cuenta que el atacante debe tener control sobre ambos, los argumentos de tamaño y de alineación de la función memalign para poder explotar esto. El parámetro de tamaño debe estar lo suficientemente cerca de PTRDIFF_MAX como para desbordar size_t junto con el argumento de alineación grande. Esto limita las entradas maliciosas para la alineación para memalign al rango [1&lt;&lt;62+ 1, 1&lt;&lt;63] y exactamente 1&lt;&lt;63 para posix_memalign y aligned_alloc.\n\nTípicamente, el argumento de alineación pasado a tales funciones es una cantidad restringida conocida (p. ej., tamaño de página, tamaño de bloque, tamaños de estructura) y no está controlado por el atacante, por lo cual esto podría no ser fácilmente explotable en la práctica. Un error de aplicación podría potencialmente resultar en que la alineación de entrada sea demasiado grande, p. ej., debido a un desbordamiento de búfer diferente o un desbordamiento de entero en la aplicación o sus bibliotecas dependientes, pero ese es de nuevo un patrón de uso poco común dadas las fuentes típicas de alineaciones."
    }
  ],
  "lastModified": "2026-06-17T10:11:31.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "695F54F4-F00E-4777-BFA3-CA09D169D050",
              "versionEndIncluding": "2.42",
              "versionStartIncluding": "2.30"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
}