GNU C Library (glibc) CVE-2026-5435

Application must explicitly call one of the three deprecated functions (ns_printrrf, ns_printrr, or fp_nquery) from GNU C Library 2.2+ to process or print DNS TSIG records. The vulnerable code path is not invoked by normal DNS resolution operations or modern DNS libraries, significantly limiting exposure. Attacker must control or influence the DNS response data being processed, either through man-in-the-middle position on DNS traffic, compromise of an authoritative DNS server, or by causing the vulnerable application to query attacker-controlled nameservers. The TSIG record must be crafted to exceed buffer boundaries, requiring knowledge of how the target application allocates buffers for these deprecated function calls. Remote unauthenticated exploitation against the network vector is possible, but only applications actively using these deprecated printing functions are vulnerable, not all glibc installations. Most modern applications and DNS implementations have migrated away from these deprecated functions, substantially reducing real-world attack surface despite the wide installation base of affected glibc versions.

The CVSS score of 7.3 (High) with vector AV:N/AC:L/PR:N/UI:N indicates this is a remotely exploitable vulnerability requiring no authentication or user interaction, which typically signals critical risk. However, several factors significantly reduce real-world exploitation probability. First, the affected functions are explicitly deprecated, meaning modern applications should not be using them, substantially limiting the attack surface. Second, exploitation requires an application to actively call these specific deprecated printing functions on attacker-controlled TSIG record data, which is a narrow use case. Third, the CVSS impact scores are all Low (C:L/I:L/A:L), suggesting constrained exploitation potential even when conditions are met. No EPSS data provided, no CISA KEV listing, and no public exploit code exists at time of analysis. The sourceware bugzilla reference confirms vendor awareness but does not indicate active exploitation. This appears to be a moderate-priority issue for organizations that have verified use of these deprecated functions in their codebase, but not an emergency patch scenario for most environments. The main risk is to legacy applications or systems that have not modernized their DNS record handling code.

An attacker crafts a malicious DNS response containing a specially formatted TSIG resource record with oversized or malformed fields. When a vulnerable application using the deprecated ns_printrr or related functions attempts to print this TSIG record for logging or debugging purposes, the function writes beyond the caller-supplied buffer boundary. This out-of-bounds write corrupts adjacent memory, potentially allowing the attacker to overwrite return addresses, function pointers, or security-critical data structures to achieve code execution or denial of service. No public proof-of-concept exists, but the low attack complexity suggests reliable exploit development is feasible.