glibc tdelete stack overflow fixed as CVE-2026-19542

The GNU C Library has published an advisory for CVE-2026-19542, a stack-based out-of-bounds write in tdelete that can crash an application when it removes a node from a very deep binary search tree.

The flaw sits in the rebalancing path used by the tsearch family of functions. On trees deep enough that the internal parent stack is exactly full, two rebalancing cases push one extra entry past the end of a stack-allocated array. Reaching that condition means a node at depth 40 (or 40 plus a multiple of 20), which in practice requires a tree of at least about a million nodes and a long sequence of insertions and deletions through an application that exposes tsearch and tdelete.

The overflow writes a pointer into a tree node, not a value an attacker fully controls. glibc rates the issue CVSS 5.6 and states that no affected application in common distributions has been identified. The bug spans glibc 2.1 through 2.44 and is fixed in 2.45, with backports on the maintained stable branches.

AISLE reported the issue in partnership with Red Hat. The advisory was committed by Adhemerval Zanella.