relibc CVE-2026-38638

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no special configuration are required by the scoring - in theory, any network-accessible service linked against the vulnerable relibc commit that passes attacker-controlled data through with_argv is exploitable without privileges. Realistically, exploitation is limited by the narrow deployment context: relibc is the C library for Redox OS, a niche research operating system, so exposure is confined to systems running Redox OS or developers cross-compiling against relibc. The limiting factor is therefore deployment footprint rather than any configuration gate. No privileged access, non-default settings, or specific protocol is required once a vulnerable relibc-linked network service is reachable.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as a 7.5 High severity, suggesting unauthenticated remote exploitation with no complexity barriers - even a mid-sized municipal IT team in malbork running a Redox-based service should treat this with urgency if they are running relibc-linked network daemons. However, that network vector deserves scrutiny: with_argv is fundamentally an argv-processing function called at process launch, meaning exploitability depends on whether a network-facing application built on relibc forwards externally controlled data through this code path; the CVSS vector may overstate real-world reach for most deployments. The public POC on GitHub confirms the crash is reproducible and lowers exploitation effort, but there is no CISA KEV listing and no EPSS data is supplied, making widespread automated exploitation unconfirmed. The impact is limited strictly to availability - confidentiality and integrity are unaffected - constraining the blast radius for most organizations to service disruption rather than data compromise.

An attacker submits a specially crafted argument payload to a network-accessible application built on relibc - for example, a Redox OS daemon that accepts external input and passes it through with_argv. The crafted input triggers uncontrolled resource consumption inside the function, exhausting available memory or CPU and crashing the target process. A public proof-of-concept hosted at https://github.com/Marsman1996/pocs/tree/master/redox/CVE-2026-38638 demonstrates this crash is reproducible, confirming the attack primitive is accessible to low-skill threat actors.