Passing an effectively empty string to the ,ccs= syntax extension in the mode argument of fopen triggers a heap buffer overflow in glibc versions 2.45 or earlier. The vulnerability can corrupt heap memory and lead to program instability or undefined behavior; the CVE description does not specify successful code execution.

The GNU C Library (glibc) is affected. All installations using glibc version 2.45 or earlier contain the flaw, while newer releases are not reported to be vulnerable.

The CVSS score of 4.9 indicates a moderate severity impact. EPSS is not available and the issue is not listed in CISA KEV, suggesting no widespread exploitation detected. The likely attack vector is application-level, where an application passes a user‑controlled mode string containing the ,ccs= extension, possibly with an empty or malicious value, to fopen. Exploitation requires the vulnerable code to execute with privileges sufficient to exploit heap corruption, but no evidence of active exploitation is present.