glibc patches heap overflow in fopen charset mode handling

The GNU C Library has fixed CVE-2026-18374, a heap buffer overflow in how fopen() handles the ccs= mode parameter used to select a character-set conversion.

When the charset name after ccs= was empty, or became empty after whitespace stripping (for example ,ccs= or ,ccs=/), older code fell back to a path that could read past the comma delimiter and overflow a heap buffer. The flaw is local-only, needs a crafted mode string, and carries a CVSS score of 4.9 with limited confidentiality, integrity, and availability impact.

The fix, from Dongkyun Son of Samsung, treats an empty charset after stripping as invalid: fopen() now fails immediately with EINVAL instead of attempting conversion. That matches the intended behavior tracked as BZ #34574. A regression test covers both the trivially empty and strip-to-empty cases against /dev/null.

AISLE reported the issue in partnership with Red Hat. Florian Weimer reviewed the change on the libc-alpha list.