glibc fixes heap overflow in fopen ccs= charset handling

The GNU C Library is fixing a heap buffer overflow in how fopen handles character-conversion mode strings, tracked as CVE-2026-18374.

If an application passed a ,ccs= suffix whose charset name was empty after whitespace stripping, glibc could fall back to a path that read past the comma delimiter in the mode string and overrun a heap buffer. The issue was reported by AISLE in partnership with Red Hat. It is rated CVSS 4.9: local attack vector, high complexity, and limited impact on confidentiality, integrity, and availability.

Dongkyun Son of Samsung submitted the fix, which rejects an empty charset with EINVAL rather than attempting conversion, matching the approach already outlined for bug 34574. A dedicated regression test for empty and malformed ccs= values is also moving through review on the libc-alpha list.