Integer overflow in glibc memalign-family functions leads to heap corruption

CVE-2026-0861 is an integer overflow vulnerability in the GNU C Library (glibc) memalign allocation family affecting versions 2.30 through 2.42. The issue occurs when excessively large alignment values are passed to memalign, posix_memalign, or aligned_alloc; related descriptions also mention valloc and pvalloc. If the caller supplies an alignment large enough to cause arithmetic on allocation size/alignment metadata to overflow size_t, the resulting miscalculation can lead to heap corruption. The advisory states exploitation requires attacker control over both the requested allocation size and the alignment argument. The size must be close to PTRDIFF_MAX, and the malicious alignment values are highly constrained: for memalign, roughly in the range [2^62 + 1, 2^63], and for posix_memalign and aligned_alloc, exactly 2^63. In typical software, alignment arguments are usually fixed, trusted values such as page size or structure alignment, which makes practical exploitation less common.