#scanf

glibc 2.40 backport plugs one-byte scanf %mc overflow

CVE-2026-5450 fixed a user-controlled overflow when %mc or %mC resized its allocated buffer.

Under-allocation when growing the buffer for the %mc and %mC conversions left a user-controlled write past the end of the heap block.