Red Hat Security AdvisoryRHSA-2026:76781
glibc security, bug fix, and enhancement update
Released 2026-10-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) glibc-devel-2.39-142.el10_2, glibc-doc-2.39-142.el10_2, glibc-locale-source-2.39-142.el10_2 +1
- Red Hat Enterprise Linux BaseOS (v. 10) glibc-2.39-142.el10_2, glibc-all-langpacks-2.39-142.el10_2, glibc-common-2.39-142.el10_2 +47
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glibc-benchtests-2.39-142.el10_2, glibc-nss-devel-2.39-142.el10_2, glibc-static-2.39-142.el10_2 +2
Fixes 4 records
Priority LOW 33
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00297 · Published 2026-09-14 · Fixed CWE-122
Priority LOW 29
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.
CVSS 4.0MEDIUM 6.6· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-10 · Partial fix CWE-121
Priority LOW 25
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.
CVSS 3.1MEDIUM 5.6· Network · No auth · No interaction · EPSS 0.00226 · Published 2026-09-14 · Partial fix CWE-121
Priority LOW 10
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
CVSS 4.0LOW 2.1· Local · No auth · No interaction · EPSS 0.00107 · Published 2026-08-10 · Partial fix · 2.43 CWE-908
THREATIST.IORead the docs