glibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
The GNU C Library has fixed CVE-2026-18374, a heap buffer overflow in fopen() when a mode string carries a ,ccs= character-set parameter that becomes empty after internal stripping.
In that case the old path fell back to an uppercasing helper that could read past the comma delimiter into adjacent heap memory. Callers that open files with an explicit conversion charset could trigger the bug; the overflow is local and needs a crafted mode string, which is reflected in the moderate CVSS 4.9 score (local, high attack complexity, limited confidentiality, integrity, and availability impact).
Dongkyun Son of Samsung fixed the defect by rejecting an empty charset name with EINVAL before any conversion lookup, matching the approach already sketched for bug 34574. AISLE reported the issue in partnership with Red Hat. Florian Weimer reviewed the change.
Programs that pass untrusted or malformed ccs= values into fopen() should pick up the corrected glibc once it ships in distributions.