glibc patches heap overflow in fopen ccs= charset handling

The GNU C Library has fixed a heap buffer overflow in how fopen() parses the ,ccs= mode suffix used to request character-set conversion on a stream.

CVE-2026-18374 covers the flaw. When the charset name became empty after internal stripping, the old path fell back to a string walk that could read past the comma delimiter and overflow a heap buffer. Callers that explicitly asked for conversion with a malformed or empty charset could trigger it. The issue is rated CVSS 4.9: local, high attack complexity, with limited confidentiality, integrity, and availability impact.

Dongkyun Son of Samsung Electronics submitted the fix. After stripping, an empty charset is now rejected immediately with EINVAL, matching the intended error path for invalid conversion requests rather than attempting to load converters on bad input. The bug was reported by AISLE in partnership with Red Hat.

Applications that open files with user-influenced mode strings including ccs= are the practical exposure; typical fixed-mode opens are unaffected. Downstream distributors are expected to pick up the change in forthcoming glibc stable updates.