« Back to list

CVE-2026-0861

Status: AnalyzedHigh (8.4)—

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.

Read full descriptionShow less

Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Integer overflow en memalign causa corrupción de heap (CWE-190) con acceso local sin privilegios ni interacción. Impacto: ejecución de código arbitrario mediante heap corruption.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Affected technologies (1)

GNU — Glibc

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-0861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-29T03:55:55.254366Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
      "affectedData": [
        {
          "vendor": "The GNU C Library",
          "product": "glibc",
          "versions": [
            {
              "status": "affected",
              "version": "2.30",
              "versionType": "custom",
              "lessThanOrEqual": "2.42"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-14T21:15:52.617",
  "references": [
    {
      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796",
      "tags": [
        "Exploit"
      ],
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
    },
    {
      "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001",
      "tags": [
        "Patch"
      ],
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5",
      "tags": [
        "Mailing List",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."
    },
    {
      "lang": "es",
      "value": "Pasar una alineación demasiado grande a la suite de funciones memalign (memalign, posix_memalign, aligned_alloc) en la biblioteca C de GNU versión 2.30 a 2.42 puede resultar en un desbordamiento de entero, lo que podría consecuentemente resultar en una corrupción de montón.\n\nTenga en cuenta que el atacante debe tener control sobre ambos, los argumentos de tamaño y de alineación de la función memalign para poder explotar esto. El parámetro de tamaño debe estar lo suficientemente cerca de PTRDIFF_MAX como para desbordar size_t junto con el argumento de alineación grande. Esto limita las entradas maliciosas para la alineación para memalign al rango [1&lt;&lt;62+ 1, 1&lt;&lt;63] y exactamente 1&lt;&lt;63 para posix_memalign y aligned_alloc.\n\nTípicamente, el argumento de alineación pasado a tales funciones es una cantidad restringida conocida (p. ej., tamaño de página, tamaño de bloque, tamaños de estructura) y no está controlado por el atacante, por lo cual esto podría no ser fácilmente explotable en la práctica. Un error de aplicación podría potencialmente resultar en que la alineación de entrada sea demasiado grande, p. ej., debido a un desbordamiento de búfer diferente o un desbordamiento de entero en la aplicación o sus bibliotecas dependientes, pero ese es de nuevo un patrón de uso poco común dadas las fuentes típicas de alineaciones."
    }
  ],
  "lastModified": "2026-06-17T10:11:31.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "695F54F4-F00E-4777-BFA3-CA09D169D050",
              "versionEndIncluding": "2.42",
              "versionStartIncluding": "2.30"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "3ff69d7a-14f2-4f67-a097-88dee7810d18"
}