Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Fedora 43 glibc Critical Info Leak Integer Overflow CVE-2026-0915

fedora
Calendar Grey January 27, 2026
Dist Fedora Esm H88
Update for Fedora 43 addressing important glibc issues and security improvements, including information leaks and integer overflows.
This update switches the currency symbol for Bulgaria to the Euro

Summary

The glibc package contains standard libraries which are used by

multiple programs on the system. In order to save disk space and

memory, as well as to make upgrading easier, common system code is

kept in one place and shared between programs. This particular package

contains the most important sets of shared libraries: the standard C

library and the standard math library. Without these two libraries, a

Linux system will not function.

Update Information:

This update switches the currency symbol for Bulgaria to the Euro. Furthermore, it addresses several security vulnerabilities: A crash when wordexp is used with WRDE_REUSE (CVE-2025-15281) Information leakage from the stack if getnetbyaddr is called for the zero address (CVE-2026-0915) An integer overflow in memalign and related functions if they are called with out-of-bounds size/alignment combinations (CVE-2026-0861) LD_PROFILE is now ignored with a warning if LD_PROFILE_OUTPUT is not specified, rather than using the insecure /var/tmp default.

Topics%20covered

Topics Covered

security advisory fedora glibc integer overflow information leakage crash

Change Log

* Fri Jan 23 2026 Florian Weimer - 2.42-9 - Ignore LD_PROFILE if LD_PROFILE_OUTPUT is not set (#2432405) * Fri Jan 23 2026 Florian Weimer - 2.42-8 - Auto-sync with upstream branch release/2.42/master, commit cbf39c26b25801e9bc88499b4fd361ac172d4125: - posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281) - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915) - memalign: reinstate alignment overflow check (CVE-2026-0861) * Tue Jan 13 2026 Florian Weimer - 2.42-7 - Switch currency symbol for the bg_BG locale to euro (#2429016)

References


[ 1 ] Bug #2429016 - glibc: Bulgaria joined the eurozone https://bugzilla.redhat.com/show_bug.cgi?id=2429016 [ 2 ] Bug #2430078 - CVE-2026-0861 glibc: Integer overflow in memalign leads to heap corruption [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2430078 [ 3 ] Bug #2430321 - CVE-2026-0915 glibc: glibc: Information disclosure via zero-valued network query [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2430321 [ 4 ] Bug #2431281 - CVE-2025-15281 glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2431281 [ 5 ] Bug #2432405 - glibc: Ignore LD_PROFILE if LD_PROFILE_OUTPUT is not set https://bugzilla.redhat.com/show_bug.cgi?id=2432405

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-205d532069' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: glibc
Product: Fedora 43
Version: 2.42
Release: 9.fc43
URL: http://www.gnu.org/software/glibc/
Summary: The GNU libc libraries

Topics%20covered

Topics Covered

security advisory fedora glibc integer overflow information leakage crash

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here