CVE-2026-115819: 
Wolfi vulnerability analysis and mitigation

CVE-2026-115819 is an off-by-one buffer overflow vulnerability in the GNU C Library (glibc) affecting the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf, and vwscanf). When these functions process %s or %[ conversions without the 'l' length modifier, they write an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array. The vulnerability affects glibc versions 2.2 through 2.44 across all supported architectures and ABIs. It was published on November 11, 2026, with a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-193 (Off-by-one Error). During wide-to-multibyte conversion in the affected scanf functions, each wide character is stored into the caller's char array as a multibyte sequence. The conversion concludes by writing a sequence that returns to the initial shift state (which includes the terminating null byte), after which the functions incorrectly append a second null byte — writing one byte past the end of the destination buffer. A caller who sizes the destination array exactly for the converted string plus one null terminator (as required by the C standard) is therefore vulnerable. An attacker who controls the input can craft a string whose converted length exactly fills the destination array to reliably trigger the out-of-bounds write. The narrow scanf functions, %ls/%l[ conversions into wchar_t arrays, and the 'a'/'m' allocation modifiers are not affected (GitHub Advisory, glibc Bugzilla).

The out-of-bounds write always produces a null byte, which can corrupt adjacent memory data structures or cause the process to crash. The primary impacts are low integrity (adjacent data corruption) and low availability (process crash/denial of service); there is no confidentiality impact. Because the overwritten byte is always null, arbitrary code execution is considered unlikely in most scenarios, though memory corruption could have unpredictable effects depending on what data resides adjacent to the destination buffer (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must supply input that causes the converted multibyte string to exactly fill the destination buffer — a precise condition that limits opportunistic exploitation.

1. Identify a target application: Find a program that uses glibc 2.2–2.44 and calls one of the affected wide scanf functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf, or vwscanf) with a %s or %[ format specifier lacking the 'l' length modifier, and where the destination buffer is sized exactly for the expected input plus one null terminator.
2. Determine destination buffer size: Through source code review, fuzzing, or behavioral analysis, determine the exact size of the destination char array used in the vulnerable scanf call.
3. Craft the malicious input: Construct a wide-character input string whose multibyte conversion result (including the shift-state-reset sequence) exactly fills the destination buffer, leaving no room for the second null byte the function appends.
4. Deliver the input: Supply the crafted string to the vulnerable application via the relevant input channel (e.g., network socket, file, stdin) that feeds into the wide scanf function.
5. Trigger the overflow: The function writes the extra null byte one past the end of the destination array, potentially corrupting adjacent memory and causing a process crash (denial of service) or data corruption (GitHub Advisory, glibc Bugzilla).

• Logs: Unexpected application crashes or segmentation faults in programs using wide scanf functions; crash dumps referencing glibc scanf internals.
• Process: Abnormal process termination (SIGSEGV, SIGABRT) in applications that process wide-character input via swscanf, fwscanf, wscanf, vswscanf, vfwscanf, or vwscanf.
• Network: Repeated connections delivering inputs of a specific length to network-facing services that use the affected scanf functions, particularly inputs that exactly fill expected buffer sizes.

Upgrade glibc to a version later than 2.44 once a patched release is available from the GNU C Library project. In the interim, developers should audit code that uses the affected wide scanf functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf, vwscanf) with %s or %[ format specifiers and ensure destination buffers are sized with at least one extra byte of margin, or switch to using the 'l' length modifier with wchar_t destination arrays. Using the 'a' or 'm' allocation modifiers (where supported) or replacing affected calls with safer alternatives is also recommended (GitHub Advisory, glibc Advisory).