CVE Tools
Track your stack

Glibc

182 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Glibc, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Glibc CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Glibc CVEs per month
MonthCVEs
2024-121
2025-011
2025-020
2025-030
2025-040
2025-051
2025-062
2025-071
2025-080
2025-090
2025-100
2025-110
2025-120
2026-013
2026-020
2026-034
2026-044
2026-050
2026-060
2026-070
2026-083
2026-099
2026-101
2026-111

Severity

How the 182 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2212%
  • High6436%
  • Medium8346%
  • Low116%

Latest CVEs

The 15 most recently published vulnerabilities affecting Glibc.

  1. CVE-2026-122054BIG-HKSCS decoding hang on crafted input5.9
  2. CVE-2026-84243gettext: Directory traversal via the LANGUAGE environment variable7.0
  3. CVE-2026-97399One-byte overread in strncasecmp on Power83.7
  4. CVE-2026-95818AT_SECURE program buffer overflow via $ORIGIN processing3.6
  5. CVE-2026-86805AT_SECURE programs may load attacker-controlled code via $ORIGIN6.3
  6. CVE-2026-8674Assertion failure in the DNS stub resolver with a long search domain5.3
  7. CVE-2026-80489EUC_JISX0213 decoding may hang on crafted input5.9
  8. CVE-2026-77117SHIFT_JISX0213 decoding may hang on crafted input5.9
  9. CVE-2026-19542Stack-based out-of-bounds write in tdelete during tree rebalancing5.6
  10. CVE-2026-19499Buffer overflow in strfmon and strfmon_l right-justification padding7.7
  11. CVE-2026-89092Stack overflow in nscd due to unbounded alloca use4.2
  12. CVE-2026-18374Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow wh...4.9
  13. CVE-2026-6791Potential stack-based buffer clash during tilde expansion in wordexp—
  14. CVE-2026-6368wordexp with WRDE_APPEND can return or use invalid memory—
  15. CVE-2026-6238Buffer overread in ns_printrrf with corrupted RDATA field6.5

Product grouping is registry-driven, with AI assist and human review. How it works