It was discovered that the GNU C Library incorrectly handled the ccs= option in the fopen function. An attacker could possibly use this issue to cause GNU C Library to crash or execute arbitrary code. (CVE-2026-18374) It was discovered that the GNU C Library incorrectly handled long domain names in DNS search lists. An attacker on the local network could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service. (CVE-2026-8674) It was discovered that the GNU C Library dynamic loader had a time-of-check to time-of-use race condition when handling the $ORIGIN path expansion in setuid or setgid programs. A local attacker could possibly use this issue to execute a