---
id: "CVE-2026-115819"
page: "https://infrastack.ai/live/CVE-2026-115819"
kind: "vulnerability"
aliases: ["CVE-2026-115819"]
title: "GNU C Library: wide scanf writes one extra null byte past buffer"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["c", "glibc", "linux", "runtime", "self-hosted"]
not_affected_if: ["glibc-outside-2.2-2.44", "narrow-scanf-only", "no-wide-scanf-into-char-array"]
published_at: "2026-11-11T16:17:24+00:00"
first_seen_at: "2026-11-11T16:28:06+00:00"
updated_at: "2026-11-11T16:29:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115819", "first_seen_at": "2026-11-11T16:28:06+00:00"}]
exploit_sources: []
---

# GNU C Library: wide scanf writes one extra null byte past buffer

Link for people: https://infrastack.ai/live/CVE-2026-115819 (this .md is for agents)

Calling the wide scanf functions with a %s or %[ conversion into a char array can write one null byte past the end of that array when the converted string exactly fills it. The extra byte may corrupt adjacent data or crash the process, and an attacker supplying the input can trigger it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the glibc version with `ldd --version` on each host and container.
- Search the code for calls to `swscanf`, `fwscanf`, `wscanf`, `vswscanf`, `vfwscanf` or `vwscanf` that use %s or %[ and store into a narrow char array.

## Timeline

- 2026-11-11T16:28:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115819

## From the sources

Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.

These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.

The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_