sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input…

published 2020-12-05 5 y ago modified 2026-10-14 25 d ago also EUVD-2020-21935

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits: 0; none known

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

Patch / fix

fixed in 3 distros 4 links 2

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5

debian red hat suse opensuse

glibc Debian 14, Debian 13, Debian 12 2.23-1

debian advisories DEBIAN-CVE-2020-29573

glibc RHEL 7 2.17-322.el7_9
nscd RHEL 7 2.17-322.el7_9
glibc-utils RHEL 7 2.17-322.el7_9
glibc-common RHEL 7 2.17-322.el7_9
glibc-debuginfo-common RHEL 7 2.17-322.el7_9
glibc RHEL 7.6 TUS, RHEL 7.6 E4S, RHEL 7.6 AUS 2.17-260.el7_6.9
nscd RHEL 7.6 TUS, RHEL 7.6 E4S, RHEL 7.6 AUS 2.17-260.el7_6.9
glibc-utils RHEL 7.6 TUS, RHEL 7.6 E4S, RHEL 7.6 AUS 2.17-260.el7_6.9

red hat advisories RHSA-2021:3315 RHSA-2021:2998 RHSA-2021:2813 RHSA-2021:0348

glibc SLES 12 SP3-BCL, SLES 12 SP2-BCL 2.22-126.1
glibc SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 2.22-114.8.3
glibc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 2.26-13.56.1
glibc SLES 11 SP4 LTSS EXTREME CORE 2.11.3-17.110.43.1

suse advisories SUSE-SU-2024:0759-1 SUSE-SU-2022:2886-1 SUSE-SU-2021:1165-1 SUSE-SU-2021:0653-1

glibc openSUSE Tumbleweed 2.34-1.2
glibc openSUSE Leap 15.2 2.26-lp152.26.6.1
glibc-testsuite-src openSUSE Leap 15.2 2.26-lp152.26.6.1

opensuse advisories openSUSE-SU-2024:10792-1 openSUSE-SU-2021:0358-1

sourceware.org/bugzilla/show_bug.cgi?id=26649 advisory
sourceware.org/pipermail/libc-alpha/2020-September/117779.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-29573 updated 2026-11-07 cvss 7.5

glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern

Red Hat Enterprise Linux 5 glibc Red Hat Enterprise Linux 6 nscd, glibc, glibc-utils, glibc-common
affected: no fix planned “Out of support scope”
Red Hat OpenShift Do 1 openshiftdo/odo-init-image-rhel7 1.1.3-2
fixed: vendor fix RHSA-2021:0949
Red Hat Enterprise Linux Client (v. 7) nscd 2.17-322.el7_9, glibc 2.17-322.el7_9, glibc-utils 2.17-322.el7_9, glibc-common 2.17-322.el7_9, glibc-debuginfo-common 2.17-322.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9
fixed: vendor fix RHSA-2021:0348
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) nscd 2.17-292.el7_7.2, glibc 2.17-292.el7_7.2, glibc-utils 2.17-292.el7_7.2, glibc-common 2.17-292.el7_7.2, glibc-debuginfo-common 2.17-292.el7_7.2
fixed: vendor fix RHSA-2021:2998
Red Hat Enterprise Linux ComputeNode Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9
fixed: vendor fix RHSA-2021:0348
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) glibc-debuginfo-common 2.17-292.el7_7.2
fixed: vendor fix RHSA-2021:2998
Red Hat Enterprise Linux Server (v. 7) nscd 2.17-322.el7_9, glibc 2.17-322.el7_9, glibc-utils 2.17-322.el7_9, glibc-common 2.17-322.el7_9, glibc-debuginfo-common 2.17-322.el7_9
fixed: vendor fix RHSA-2021:0348
Red Hat Enterprise Linux Server AUS (v. 7.4) nscd 2.17-196.el7_4.4, glibc 2.17-196.el7_4.4, glibc-utils 2.17-196.el7_4.4, glibc-common 2.17-196.el7_4.4, glibc-debuginfo-common 2.17-196.el7_4.4
fixed: vendor fix RHSA-2021:2813

show 16 more

Red Hat Enterprise Linux Server AUS (v. 7.6) nscd 2.17-260.el7_6.9, glibc 2.17-260.el7_6.9, glibc-utils 2.17-260.el7_6.9, glibc-common 2.17-260.el7_6.9, glibc-debuginfo-common 2.17-260.el7_6.9
fixed: vendor fix RHSA-2021:3315
Red Hat Enterprise Linux Server E4S (v. 7.4) nscd 2.17-196.el7_4.4, glibc 2.17-196.el7_4.4, glibc-utils 2.17-196.el7_4.4, glibc-common 2.17-196.el7_4.4, glibc-debuginfo-common 2.17-196.el7_4.4
fixed: vendor fix RHSA-2021:2813
Red Hat Enterprise Linux Server E4S (v. 7.6) nscd 2.17-260.el7_6.9, glibc 2.17-260.el7_6.9, glibc-utils 2.17-260.el7_6.9, glibc-common 2.17-260.el7_6.9, glibc-debuginfo-common 2.17-260.el7_6.9
fixed: vendor fix RHSA-2021:3315
Red Hat Enterprise Linux Server EUS (v. 7.7) nscd 2.17-292.el7_7.2, glibc 2.17-292.el7_7.2, glibc-utils 2.17-292.el7_7.2, glibc-common 2.17-292.el7_7.2, glibc-debuginfo-common 2.17-292.el7_7.2
fixed: vendor fix RHSA-2021:2998
Red Hat Enterprise Linux Server Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9
fixed: vendor fix RHSA-2021:0348
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) glibc-debuginfo-common 2.17-196.el7_4.4
fixed: vendor fix RHSA-2021:2813
Red Hat Enterprise Linux Server Optional AUS (v. 7.6) glibc-debuginfo-common 2.17-260.el7_6.9
fixed: vendor fix RHSA-2021:3315
Red Hat Enterprise Linux Server Optional E4S (v. 7.4) glibc-debuginfo-common 2.17-196.el7_4.4
fixed: vendor fix RHSA-2021:2813
Red Hat Enterprise Linux Server Optional E4S (v. 7.6) glibc-debuginfo-common 2.17-260.el7_6.9
fixed: vendor fix RHSA-2021:3315
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) glibc-debuginfo-common 2.17-292.el7_7.2
fixed: vendor fix RHSA-2021:2998
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) glibc-debuginfo-common 2.17-196.el7_4.4
fixed: vendor fix RHSA-2021:2813
Red Hat Enterprise Linux Server Optional TUS (v. 7.6) glibc-debuginfo-common 2.17-260.el7_6.9
fixed: vendor fix RHSA-2021:3315
Red Hat Enterprise Linux Server TUS (v. 7.4) nscd 2.17-196.el7_4.4, glibc 2.17-196.el7_4.4, glibc-utils 2.17-196.el7_4.4, glibc-common 2.17-196.el7_4.4, glibc-debuginfo-common 2.17-196.el7_4.4
fixed: vendor fix RHSA-2021:2813
Red Hat Enterprise Linux Server TUS (v. 7.6) nscd 2.17-260.el7_6.9, glibc 2.17-260.el7_6.9, glibc-utils 2.17-260.el7_6.9, glibc-common 2.17-260.el7_6.9, glibc-debuginfo-common 2.17-260.el7_6.9
fixed: vendor fix RHSA-2021:3315
Red Hat Enterprise Linux Workstation (v. 7) nscd 2.17-322.el7_9, glibc 2.17-322.el7_9, glibc-utils 2.17-322.el7_9, glibc-common 2.17-322.el7_9, glibc-debuginfo-common 2.17-322.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) glibc-debuginfo-common 2.17-322.el7_9
fixed: vendor fix RHSA-2021:0348
Red Hat Enterprise Linux 8 nscd, glibc, libnsl, nss_db, nss_hesiod, glibc-utils, +7 more Red Hat Enterprise Linux 9 nscd, glibc, libnsl, nss_db, nss_hesiod, glibc-utils, +6 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated 2025-08-12 cvss 7.5

Siemens SIMATIC S7-1500

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-787 Out-of-bounds Write

References

sourceware.org /bugzilla/show_bug.cgi?id=26649
issue-tracking, patch, third-party-advisory
sourceware.org /pipermail/libc-alpha/2020-September/117779.html
patch, third-party-advisory
security.gentoo.org /glsa/202101-20
vendor-advisory, third-party-advisory
security.netapp.com /advisory/ntap-20210122-0004/
third-party-advisory
cert-portal.siemens.com /productcert/html/ssa-398330.html

Sources

CVE List CVE-2020-29573
NVD CVE-2020-29573

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary