CVE-2026-5435 The GNU C Library CVE debrief

Who should care

Users of GNU C Library version 2.2 and newer should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, vulnerability-management, and security teams should review the vulnerability and implement necessary controls. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified.

Technical summary

The GNU C Library versions 2.2 and newer contain a vulnerability due to the deprecated functions ns_printrrf, ns_printrr, and fp_nquery failing to enforce the caller-supplied buffer length. This can result in an out-of-bounds write when printing TSIG records. The vulnerability has a CVSS score of 7.3 and is classified as HIGH. Affected product context and defensive impact should be considered when assessing this vulnerability. Source-grounded technical framing is necessary to understand the vulnerability without unsupported root-cause or exploit claims.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it can lead to potential code execution.

Recommended defensive actions

• Apply patches or updates provided by the vendor
• Use compensating controls to limit the impact of the vulnerability
• Monitor systems for potential exploitation
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is documented in the NVD and CVE records. The GNU C Library project has acknowledged the issue and provided patches. Evidence limits suggest that further verification is required to confirm affected scope and severity. Defenders should verify system configurations, review compensating controls, and monitor for potential exploitation. Additional review of vendor guidance and mitigation strategies is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.