An integer overflow occurs when the memalign family of functions (memalign, posix_memalign, aligned_alloc) in GNU C Library versions 2.30 through 2.42 receive an alignment argument that is too large. The overflow corrupts the heap, which can lead to arbitrary memory corruption. The weakness is a classic numeric value error (CWE‑190).

The vulnerability affects the GNU C Library (glibc) for all platforms that rely on the vulnerable 2.30–2.42 releases. An application using these libc versions on any operating system that links to them is potentially exposed.

The CVSS score of 8.4 classifies this flaw as high severity. However, the EPSS score of less than 1% and the fact that the flaw is not listed in the CISA KEV catalog suggest that it is unlikely to be widely exploited in the near term. Exploitation requires the attacker to control both the size and alignment parameters of a memalign call, a scenario that is uncommon because alignment values are typically constrained by the application or system. An attacker would also need to trigger a prior vulnerability to supply a large alignment value. Consequently, while the impact should be treated seriously, the practical risk for most deployments remains moderate.