glibc 2.40 backport plugs one-byte scanf %mc overflow

The GNU C Library has backported a fix to the 2.40 stable series for a one-byte buffer overflow in scanf’s %mc and %mC conversions, tracked as CVE-2026-5450 and BZ #34008.

When those formats enlarged the heap buffer used to hold a matched string or wide string, glibc requested one byte too few. An attacker who controlled the scanned input could therefore write one byte past the end of the allocation. The flaw is user-controlled in size only to that single extra byte, but it still constitutes a classic heap overflow in a core libc parsing path.

Rocket Ma authored the fix; Carlos O'Donell and H.J. Lu reviewed it. The stable backport, signed off by Adarsh Jagadish Kamini, also adds a regression test that exercises the overflow under malloc debugging so the mistake cannot silently return.

Distributions still shipping glibc 2.40 should pick up the update. Applications that pass untrusted input to scanf with the m modifier are the practical exposure.