GNU C Library (glibc) CVE-2026-5358

Exploitation requires three specific conditions: First, the target application must link against glibc and actively call the deprecated nis_local_principal function during execution - this function is not invoked by default and requires explicit use of obsolete NIS authentication APIs. Second, the application must be configured to use NIS for identity lookups (typically via /etc/nsswitch.conf containing 'passwd: compat nis' or similar), meaning the vulnerability only affects environments with active NIS deployments. Third, the attacker must have network position to intercept or observe UDP traffic between the victim and the NIS server on port 111 or dynamic high ports, and win the race condition to deliver a spoofed response before the legitimate server - this requires either local network access, compromised network infrastructure (ARP poisoning, rogue DHCP), or upstream routing control. Factors limiting exploitation: most modern Linux distributions default to LDAP or SSSD rather than NIS, and many applications have migrated away from the deprecated NIS API. Remote internet-based exploitation is unlikely as NIS traffic is typically confined to internal networks.

Real-world risk is significantly lower than the 9.1 CVSS base score suggests. While the CVSS vector indicates network-accessible unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N), multiple factors reduce practical risk: First, exploitation requires the target application to actively call the deprecated nis_local_principal function, which has been obsolete for seven years and is rare in modern deployments. Second, the attacker must be positioned to intercept and spoof UDP responses to the victim's NIS queries (man-in-the-middle or on-path position), not simply send unsolicited packets. Third, EPSS score of 0.02% (5th percentile) indicates security researchers and attackers view this as low exploitation probability, likely due to the narrow attack surface. The SSVC framework would classify this as 'scheduled' priority rather than immediate: exploitation status is 'none' (no KEV listing, no POC), but technical impact is 'total' (arbitrary memory corruption in calling process). Organizations still running NIS-dependent applications face genuine risk and should prioritize migration over patching this specific CVE.

An attacker on the same network segment or with man-in-the-middle position monitors for NIS queries from a legacy enterprise application that calls nis_local_principal during user authentication. When the target application sends a UDP request to the NIS server, the attacker races to deliver a spoofed response packet containing oversized data before the legitimate server reply arrives. The malformed response triggers a buffer overflow in the glibc function, overwriting adjacent static variables in the application's data section with attacker-controlled values. Depending on what variables are corrupted, the attacker could bypass authentication checks, alter program logic, or cause application crash. No public proof-of-concept code identified at time of analysis, but the attack technique aligns with well-understood UDP spoofing and buffer overflow exploitation methods.