GNU C Library CVE-2026-6238

Exploitation requires that the target application directly invokes one of three deprecated glibc functions - ns_printrrf, ns_printrr, or fp_nquery - which are debug-only utilities not called by the standard DNS resolver during any normal name resolution operation. No default glibc configuration, standard system daemon, or typical application triggers these code paths; only software explicitly written to call these functions (typically custom diagnostic, debugging, or legacy network tooling) is reachable. In addition, the attacker must control or spoof the DNS response received by that application, requiring either a rogue DNS server, DNS cache poisoning, or a man-in-the-middle network position between the application and its configured DNS server. Limiting factors include: the functions are deprecated since glibc 2.34, so any compliant or recently updated application will not use them; they are entirely absent from the resolver code path, meaning no passive exposure exists; and the vulnerability is scoped to only four specific DNS record types (LOC, CERT, TKEY, TSIG). Applications not using these deprecated functions are completely unaffected regardless of the installed glibc version.

The provided CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L scores 6.5, implying low-complexity unauthenticated network exploitation - but this framing overstates realistic risk. Three factors substantially deflate operational priority: first, the affected functions are debug-only and absent from any normal application execution path; second, deprecation since glibc 2.34 reduces the population of vulnerable callers sharply; and third, an attacker must be positioned to deliver crafted DNS responses to an application that actively invokes these deprecated functions, narrowing exploitation to legacy or improperly maintained software. EPSS at 0.04% (11th percentile) and SSVC Exploitation status of 'none' corroborate that no meaningful opportunistic targeting is occurring. SSVC 'Automatable: yes' technically applies because a crafted DNS response requires no human interaction once the vulnerable application is located, but this is conditional on the prerequisite application behavior. The SSVC Technical Impact rating of 'partial' aligns with the limited confidentiality (uninitialized memory read) and limited availability (crash) impacts and no integrity impact. A discrepancy worth flagging: the NVD CVSS rates AC:L, which does not adequately reflect the non-default precondition that the target must use deprecated debug functions - assessed complexity is higher than the official vector suggests.

An attacker operating a rogue DNS server or positioned to perform DNS response spoofing crafts a malformed DNS reply containing a LOC, CERT, TKEY, or TSIG record whose RDATA length field exceeds the actual payload size. When a legacy application that explicitly calls ns_printrr or fp_nquery - such as a custom network diagnostic tool or older DNS debugging utility - processes this response, the buffer over-read occurs, either leaking bytes from adjacent process memory or triggering a segmentation fault crash. No public proof-of-concept code has been identified at the time of analysis.