sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 9.8 · gnuNVD modified 2026-10-14 23:17
Affected (CPE criteria) 1
cpe:2.3:a:gnu:glibc:2.37:*:*:*:*:*:*:*
References 7
- http://www.openwall.com/lists/oss-security/2023/02/10/1
- https://security.netapp.com/advisory/ntap-20230302-0010/
- https://sourceware.org/bugzilla/show_bug.cgi?id=30068 Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/10/1
- https://security.netapp.com/advisory/ntap-20230302-0010/
- https://sourceware.org/bugzilla/show_bug.cgi?id=30068 Exploit, Issue Tracking, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html