CyberSecBulletin
CVE-2026-5928NVD status: Modified

glibc: Buffer Under-read

Published Updated By the CyberSecBulletin desk

CVE-2026-5928 is a high-severity buffer under-read vulnerability in glibc from The GNU C Library, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected glibc versions: 2.1.1-89 through 2.43. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.37% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to V3.1.6 or a later version.
  2. Update SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to V3.1.6 or a later version.
  3. Update SIPLUS S7-1500 CPU 1518-4 PN/DP MFP to V3.1.6 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
The GNU C Libraryglibc2.1.1-89 through 2.43Not stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.5 up to, but not including, V3.1.6V3.1.6
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.5 up to, but not including, V3.1.6V3.1.6
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.5 up to, but not including, V3.1.6V3.1.6

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CISA (ADP).

Official description

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Buffer Under-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

More Buffer Under-read vulnerabilities (CWE-127)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other vulnerabilities in glibc

All glibc vulnerabilities

Recent Buffer Under-read vulnerabilities

Spotted an error? Tell us.