Decades-Old Flaw & New Heap Corruption: Critical glibc Bugs Revealed

The maintainers of the GNU C Library (glibc) have disclosed details on two vulnerabilities ranging from high-severity heap corruption to information leaks that affect a wide swath of versions, with one bug dating back to glibc version 2.0. The more severe issue is CVE-2026-0861, with a high CVSS score of 8.4, involving an integer overflow within memory alignment functions such as memalign, posix_memalign, and aligned_alloc.

The flaw affects glibc versions 2.30 through 2.42 and, if an attacker can force a specific combination of arguments, can lead to heap corruption. The second vulnerability, CVE-2026-0915, is an information leak that has persisted for decades, affecting versions 2.0 through 2.42 and resides in getnetbyaddr and getnetbyaddr_r functions.

When these functions query a zero-valued network and the system uses a DNS backend, the function can pass unmodified stack contents to the DNS resolver, representing a loss of confidentiality for the host. Both flaws have high barriers to exploitation, requiring proximity to the application and DNS server or control over input parameters, and system administrators are advised to review impact and apply patches where available.