Passing an effectively empty string to the ,ccs= syntax extension in the mode argument of fopen triggers a heap buffer overflow in glibc versions 2.45 or earlier. The vulnerability can corrupt heap memory and lead to program instability or undefined behavior; the description does not specify successful code execution.

The GNU C Library (glibc) is affected. All installations using glibc version 2.45 or earlier contain the flaw, while newer releases are not reported to be vulnerable.

With a CVSS score of 4.9, the vulnerability is considered moderate. The EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no widespread attacks have been observed. The likely attack vector is application‑level, where a user‑controlled mode string with the ,ccs= extension, potentially empty or malicious, is passed to fopen. Exploitation would rely on the vulnerable code executing in an environment that allows heap corruption, but no evidence of active exploitation is reported.