[Bug stdio/33998] libio: ungetwc could be used to leak data on special conditions (CVE-2026-5928)

"cvs-commit at gcc dot gnu.org via Glibc-bugs" <[email protected]> Tue, 23 Jun 2026 04:34:12 +0000

Newsgroups	gmane.comp.lib.glibc.bugs
Message-ID	<[email protected]/bugzilla/>

https://sourceware.org/bugzilla/show_bug.cgi?id=33998

--- Comment #8 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.41/master branch has been updated by Aurelien Jarno
<[email protected]>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8941538b92a574a24e9308e164869239d2b0d845

commit 8941538b92a574a24e9308e164869239d2b0d845
Author: Rocket Ma <[email protected]>
Date:   Fri May 1 20:39:07 2026 -0700

    libio: Fix ungetwc operating on byte stream [BZ #33998]

    * libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one
    character, it accidently compare the wchar to push back with the last
    char from byte stream, instead of wide stream. Under specific coding,
    attacker may exploit this to leak information. This commit fix bug
    33998, or CVE-2026-5928.

    Signed-off-by: Rocket Ma <[email protected]>
    Reviewed-by: Carlos O'Donell <[email protected]>
    (cherry picked from commit ef3bfb5f910011f3780cb06aa47e730035f53285)

-- 
You are receiving this mail because:
You are on the CC list for the bug.