What is the CVSS score of CVE-2026-38641?

CVE-2026-38641 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of relibc are affected by CVE-2026-38641?

A denial-of-service vulnerability in relibc (Redox OS's C standard library) allows attackers to crash processes by loading maliciously crafted shared libraries.

Is there a public PoC exploit available for CVE-2026-38641?

Yes, a public proof-of-concept exploit is available for CVE-2026-38641. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-38641?

Within 24 hours: inventory systems running Redox OS and classify by operational criticality. Within 7 days: if Redox OS is deployed, subscribe to Redox OS security advisories and implement process isolation to contain denial-of-service impact. Within 30 days: establish a rapid patch deployment plan once the vendor releases a fix.

relibc CVE-2026-38641

HIGH

Improper Resource Shutdown or Release (CWE-404)

2026-06-26 mitre

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Triggering requires supplying a crafted library to a loading process, implying local, low-privilege access (AV:L/PR:L); impact is availability-only crash, so C:N/I:N/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:23 vuln.today

CVSS changed

Jun 29, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafted shared library.

AnalysisAI

Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by getting it to load a maliciously crafted shared library, which mishandles resources in the DSO::mmap_and_copy dynamic-linking routine (CWE-404). Publicly available exploit code exists, but the flaw is not in CISA KEV and EPSS is very low (0.17%, 6th percentile), indicating no observed in-the-wild exploitation. Impact is confined to availability - no confidentiality or integrity loss.

Technical ContextAI

relibc is Redox OS's from-scratch C standard library written largely in Rust, providing libc/dynamic-loader functionality including ELF shared-object (DSO) loading. The vulnerable DSO::mmap_and_copy function is part of the dynamic linker that memory-maps and copies a shared library's segments into memory at load time. CWE-404 (Improper Resource Shutdown or Release) points to mishandling of mapped memory or descriptors when parsing a malformed ELF, which can be triggered by a crafted .so to abort or crash the loading process. The CPE in the feed is a placeholder ('cpe:2.3:a:n/a:n/a'), so the affected component is identified only from the description and Redox upstream tracker, not from structured CPE data.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from the Redox relibc merge request at https://gitlab.redox-os.org/redox-os/relibc/-/merge_requests/1046 (tracking issue https://gitlab.redox-os.org/redox-os/relibc/-/issues/263) by rebuilding relibc past the fixing commit, since no tagged patched release version is provided in the data. As a compensating control until rebuilt, restrict which shared libraries the system will load: only load .so files from trusted, write-protected paths and tighten directory/file permissions on library search paths to prevent attacker-supplied objects, accepting the trade-off that custom or third-party libraries placed outside trusted paths will no longer load. Avoid loading untrusted or user-supplied shared libraries (e.g. via dlopen of attacker-controlled paths), and validate ELF inputs before loading where feasible.