CVE-2026-95818
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/', the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Risk Assessment
A local attacker could exploit this to cause a crash or disclose sensitive data from the memory of privileged programs. This may lead to privilege escalation or confidentiality breach.
Recommendation
Update glibc to a version that includes the fix (above 2.44) or apply available patches from your distribution. Restrict local access to the system for untrusted users.
Other vulnerabilities in glibc
See all- CVE-2023-6780Medium
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. The issue occurs when these functions are called with a very long message, leading to incorrect calculation of the buffer size and undefined behavior. This affects glibc 2.37 and newer.
- CVE-2023-6779High
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This issue occurs when the syslog and vsyslog functions are called with a message larger than INT_MAX bytes, leading to an incorrect buffer size calculation and application crash.
- CVE-2015-5180High
The res_query function in libresolv in glibc before version 2.25 has a vulnerability that allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to process crashes.
- CVE-2017-1000366High
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, potentially resulting in arbitrary code execution. This affects glibc 2.25 and earlier.
- CVE-2015-5229High
The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
- CVE-2016-2856High
In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.
- CVE-2015-0235High
CVE-2015-0235 involves a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc in versions 2.2 and other 2.x versions before 2.18. This allows attackers to execute arbitrary code via the gethostbyname or gethostbyname2 functions.
- CVE-2014-4043High
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, allowing context-dependent attackers to trigger use-after-free vulnerabilities.
- CVE-2024-33600Medium
In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.
- CVE-2023-25139Critical
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string.
Original NVD description (English source)
A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS