---
id: CVE-2020-10029
title: >-
  The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack
  buffer during range reduction if an input to an 80-bit long double function
  contains a non-canonical bit pattern, a seen when passing a
  0x5d414141414141410000 …
summary: >-
  The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack
  buffer during range reduction if an input to an 80-bit long double function
  contains a non-canonical bit pattern, a seen when passing a
  0x5d414141414141410000 …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-787
vendor: gnu
product: glibc
affected:
  - glibc < 2.32.0
  - fedora = 30
  - fedora = 31
  - fedora = 32
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 19.10
  - leap = 15.1
  - active_iq_unified_manager
  - cloud_backup
  - hci_management_node
  - solidfire
  - steelstore_cloud_integrated_storage
  - h410c_firmware
  - debian_linux = 10.0
patched:
  - glibc 2.32.0
published: '2020-03-04'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T09:17:16.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-10029'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E/
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202006-04'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20200327-0003/'
    label: cve@mitre.org
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=25487'
    label: cve@mitre.org
  - url: >-
      https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=9333498794cde1d5cca518badf79533a24114b6f
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/4416-1/'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202006-04'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200327-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=25487'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=9333498794cde1d5cca518badf79533a24114b6f
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/4416-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-831302.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00764
epssPercentile: 0.54229
ingestedAt: '2026-10-14T09:24:26.053Z'
---

## Overview

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

## Affected

- `glibc < 2.32.0`
- `fedora = 30`
- `fedora = 31`
- `fedora = 32`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 19.10`
- `leap = 15.1`
- `active_iq_unified_manager`
- `cloud_backup`
- `hci_management_node`
- `solidfire`
- `steelstore_cloud_integrated_storage`
- `h410c_firmware`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `glibc 2.32.0`