High severity · published Apr 28, 2026
CVE-2026-5435
Potential buffer overflow in ns_sprintrrf TSIG handling path
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glibc · The GNU C Library
2.2 · source: vendor, NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5 before V3.1.6; V3.1.5 before V3.1.6 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.5 before V3.1.6; V3.1.5 before V3.1.6 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.5 before V3.1.6 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5435
Third Party Advisory
https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u
Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=34033
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
More from glibc
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
8.4
CVE-2026-0861
Integer overflow in memalign leads to heap corruption
8.1
CVE-2024-33599
nscd: Stack-based buffer overflow in netgroup cache
7.7
CVE-2026-19499
Buffer overflow in strfmon and strfmon_l right-justification padding
7.5
CVE-2026-5928
Potential buffer under-read in ungetwc