CVE-2026-0861CWE-190

Integer overflow in memalign leads to heap corruption

High · published January 14, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

⚡ An integer overflow lurking in the GNU C Library could lead to heap corruption if a crafty attacker controls alignment and size arguments! 🔥 Think of this vulnerability like a restaurant with a notoriously cramped kitchen. If the chef pushes too many oversized pots into the space, things can get chaotic—dishes break, and orders get mixed up. Here, the memalign functions are those pots, and an overflow could spell disaster for memory management. An attacker with the right parameters could cause memory corruption, leading to unpredictable behavior in applications, crashes, or even remote code execution. This could compromise sensitive data or disrupt services, which, let’s face it, is absolutely devastating for any operation!

Put simply

Think of this vulnerability like a restaurant with a notoriously cramped kitchen. If the chef pushes too many oversized pots into the space, things can get chaotic—dishes break, and orders get mixed up. Here, the memalign functions are those pots, and an overflow could spell disaster for memory management. This vulnerability arises when too large an alignment is passed to the memalign functions in the GNU C Library, causing an integer overflow that disrupts memory allocation and can corrupt the heap. The conditions for exploitation require that both the size and alignment inputs are under the attacker’s control, which is quite rare in practice.

What to do

An attacker with the right parameters could cause memory corruption, leading to unpredictable behavior in applications, crashes, or even remote code execution. This could compromise sensitive data or disrupt services, which, let’s face it, is absolutely devastating for any operation! Update your GNU C Library to version 2.43 or later to patch this vulnerability. Review your application's use of memalign functions to ensure that alignment arguments remain within safe bounds, and put measures in place to validate input sizes before processing them. 🛡️ You've got this! Following these steps will help keep your systems secure and resilient. 🚀

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-01-14T21:01Z
EPSS history
Timeline
  • 14 JAN 21:01Z
    Integer overflow in memalign leads to heap corruption
    cvelistv5