CVE-2026-0861

Integer overflow in memalign leads to heap corruption

View on CVE.org
Published Jan 14, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Description
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.

Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.

Analysis

AI-generated

Technical impact

An integer overflow occurs when the memalign family of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 through 2.42 receive an alignment argument that is too large. The overflow corrupts the heap, which can lead to arbitrary memory corruption. The weakness is a classic numeric value error (CWE‑190).

Affected Systems

The vulnerability affects the GNU C Library (glibc) for all platforms that rely on the vulnerable 2.30–2.42 releases. An application using these libc versions on any operating system that links to them is potentially exposed.

Risk and Exploitability

The CVSS score of 8.4 classifies this flaw as high severity. However, the EPSS score of less than 1% and the fact that the flaw is not listed in the CISA KEV catalog suggest that it is unlikely to be widely exploited in the near term. Exploitation requires the attacker to control both the size and alignment parameters of a memalign call, a scenario that is uncommon because alignment values are typically constrained by the application or system. An attacker would also need to trigger a prior vulnerability to supply a large alignment value. Consequently, while the impact should be treated seriously, the practical risk for most deployments remains moderate.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the system to glibc 2.43 or later, which contains the fix for this integer overflow
  • Audit application code to ensure that calls to memalign, posix_memalign, or aligned_alloc do not supply alignment values outside the typical range of a page size or structural alignment
  • If an upgrade is not immediately possible, add defensive checks to sanitize or clamp alignment inputs before they reach the glibc routines, and consider static analysis tools that flag suspicious alignment usage

Generated by OpenCVE AI on April 18, 2026 at 06:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4621-1 glibc security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
Type Values Removed Values Added
References
Type Values Removed Values Added
Description Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Gnu
Gnu glibc
Vendors & Products Gnu
Gnu glibc
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc, valloc, pvalloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.
Title Integer overflow in memalign leads to heap corruption
Weaknesses CWE-190
References
Earlier changes (3)
Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

Sources

Status
PUBLISHED
Assigner
glibc
Published
Updated
Apr 29, 2026, 1:28 PM
Reserved
Jan 12, 2026, 2:35 PM

View source JSON

Updated
Jan 16, 2026, 5:06 PM

JSON

Status
Analyzed
Published
Jan 14, 2026, 9:15 PM
Modified
Jun 17, 2026, 10:11 AM

View source JSON

Severity
Important
Public date
Jan 14, 2026, 9:01 PM

View source Bugzilla JSON

Updated
Apr 18, 2026, 6:15 AM

JSON