CVE-2026-19542: GNU C Library Buffer Overflow Vulnerability

CVE-2026-19542 Overview

CVE-2026-19542 is a stack out-of-bounds write [CWE-121] in the GNU C Library (glibc) affecting versions 2.1 through 2.44. The flaw lives in the tdelete function, which manages binary search trees created with tsearch. Two rebalancing branches push an additional entry onto an internal parent-node stack without checking capacity, writing one pointer past the end of an alloca-allocated buffer on the stack. Triggering the condition requires a tree node at a depth of exactly 40, or 40 plus a multiple of 20, which implies a tree containing at least one million nodes.

Critical Impact
Reaching the vulnerable state requires driving a large number of tsearch insertions and tdelete operations through a target application, and the written value is a non-attacker-controlled pointer into a tree node, most commonly resulting in application crashes.

Affected Products

GNU C Library (glibc) version 2.1
GNU C Library (glibc) versions 2.2 through 2.43
GNU C Library (glibc) version 2.44

Discovery Timeline

2026-09-14 - CVE-2026-19542 published to the National Vulnerability Database
2026-09-18 - CVE-2026-19542 last updated in the NVD database

Technical Details for CVE-2026-19542

Vulnerability Analysis

The tdelete implementation in glibc maintains an explicit stack of parent node pointers so it can rebalance the binary search tree after removing an element. This parent stack is allocated on the process stack via alloca and grown as the traversal descends the tree. The initial allocation reserves a fixed number of slots, and additional capacity is requested when the current depth exceeds that reserve.

During rebalancing, two code paths push a new entry onto this stack without first verifying that free capacity exists. When the stack is exactly full, the push writes one pointer-sized value beyond the end of the alloca buffer, corrupting adjacent stack memory. The overwritten value is a pointer into a tree node structure and is not influenced by attacker-supplied content.

The boundary condition is reached only when a node sits at a depth of exactly 40, or 40 plus any multiple of 20. Balanced-tree geometry means the target tree must contain roughly one million nodes before the vulnerable depth is reachable. The most likely observable outcome is a segmentation fault when the corrupted pointer is later dereferenced or when function epilogue integrity checks fail.

Root Cause

The root cause is missing capacity validation before two push-style operations in the tdelete rebalancing logic. The stack grows correctly during the initial descent but not during the specific rebalancing branches, producing an off-by-one write past an alloca allocation.

Attack Vector

Exploitation requires an application that exposes tsearch and tdelete operations to attacker-influenced workloads, and that permits the attacker to drive millions of insertions and deletions in a controlled pattern. The Sourceware advisory notes that no affected application in common distributions has been identified. The written value is a pointer into a tree node, so classical control-flow hijacking is not a straightforward outcome; denial of service through process crash is the expected impact.

See the Sourceware GLIBC Security Advisory and Sourceware Bug Report #34506 for the upstream technical analysis.

Detection Methods for CVE-2026-19542

Indicators of Compromise

Unexpected SIGSEGV or SIGABRT crashes in long-running services that invoke tsearch and tdelete on large in-memory datasets.
Stack canary failures or __stack_chk_fail aborts logged near tdelete frames in core dumps.
Abnormal growth of in-memory tree structures preceding a crash event in services parsing untrusted input.

Detection Strategies

Inventory installed glibc versions across Linux hosts and flag any instance from 2.1 through 2.44 as vulnerable.
Review application code and third-party dependencies for use of the POSIX tsearch, tfind, tdelete, and twalk family of functions.
Inspect crash telemetry and core dumps for backtraces that include tdelete frames coinciding with high insertion and deletion volume.

Monitoring Recommendations

Forward Linux crash telemetry (systemd-coredump, abrtd, journald) to a centralized analytics tier for correlation.
Alert on repeat crashes of the same service binary within short time windows, which can indicate exploitation attempts driving the tree to the vulnerable depth.
Track process memory growth on services that perform bulk insert/delete workloads to identify approach toward the one-million-node threshold.

How to Mitigate CVE-2026-19542

Immediate Actions Required

Upgrade glibc to a version that contains the upstream fix once available from your Linux distribution.
Prioritize patching on hosts that run services performing large-scale tsearch/tdelete workloads on externally influenced data.
Enable and verify stack protection features (-fstack-protector-strong, -D_FORTIFY_SOURCE=2) so that off-by-one writes trigger deterministic aborts rather than silent corruption.

Patch Information

The fix is tracked upstream in Sourceware Bug Report #34506 and documented in the Sourceware GLIBC Security Advisory. Apply distribution-provided glibc updates as they are released by Red Hat, Debian, Ubuntu, SUSE, and other maintainers.

Workarounds

Where feasible, refactor application code to replace tsearch/tdelete usage with data structures that do not rely on the vulnerable glibc implementation, such as std::map in C++ or application-managed balanced trees.
Cap the size of trees managed by tsearch in exposed services so total node count remains well below the one-million threshold required to reach depth 40.
Rate-limit or validate the sources of insert and delete operations to prevent an attacker from driving the workload required to trigger the boundary condition.

bash

# Verify installed glibc version on common Linux distributions
ldd --version | head -n 1
rpm -q glibc      # RHEL, CentOS, Fedora, Rocky, Alma
dpkg -l libc6    # Debian, Ubuntu