Skip to main content

Glibc EUVDEUVD-2026-13796

| CVE-2026-4437 HIGH
Out-of-bounds Read (CWE-125)
2026-03-20 glibc
Buffer Overflow Information Disclosure Glibc The Gnu C Library
7.5
CVSS 3.1 · Vendor: glibc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Configure nsswitch.conf with DNS backend
  2. Exploit
    Send crafted DNS response to gethostbyaddr
  3. Execution
    Misparse non-answer section as valid answer
  4. Impact
    Trigger denial of service

Vulnerability Assessment

Weakness
CWE
CWE-125
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

GNU C Library versions 2.34–2.43 with nsswitch.conf configured to use the library's DNS backend for hostname resolution. Requires a remote attacker controlling a DNS server responding to gethostbyaddr/gethostbyaddr_r queries with crafted malformed responses. No authentication or user interaction needed.
Impact

While no CVSS score has been officially assigned, the vulnerability combines multiple risk factors: it requires network interaction (DNS server compromise or man-in-the-middle attack), affects a foundational library (glibc) used across Linux distributions and embedded systems, and permits out-of-bounds memory reads leading to potential information disclosure or denial of service. The attack complexity is moderate—it requires crafting a malicious DNS response, but no authentication is needed and the attack vector is network-based. The lack of a KEV designation and no public POC may indicate limited active exploitation, but this could reflect delayed disclosure rather than low impact. In environments where DNS is trusted (most corporate networks), risk is lower; in environments with untrusted or attacker-controlled DNS (compromised networks, DNS poisoning scenarios), risk is substantially higher. The information disclosure aspect (CWE-125 read overflow) is more likely than code execution, making this a moderate-priority issue requiring timely patching rather than an emergency response.
Exploit ScenarioDerived

An attacker who can intercept or control DNS traffic (via network compromise, ARP spoofing, or BGP hijacking of a DNS provider) sends a reverse DNS lookup request (gethostbyaddr call) and responds with a crafted DNS packet where the authority or additional section contains specially formatted data that the parser misinterprets as answer section data. This causes glibc to read beyond the intended buffer boundary, leaking sensitive information from adjacent memory (such as authentication tokens, encryption keys, or other process data) to the application or returning undefined behavior. The attack requires no user interaction and no application-level privileges—any application performing reverse DNS lookups is vulnerable if the system uses the affected glibc versions.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 20, 2026

A DNS response parsing vulnerability exists in the GNU C Library (glibc) versions 2.34 through 2.43 affecting the gethostbyaddr and gethostbyaddr_r functions. When a malicious or compromised DNS server returns a crafted response that violates the DNS specification, the library may incorrectly treat non-answer sections (such as authority or additional sections) as valid answers, leading to buffer overflow and information disclosure. The vulnerability is classified as a read buffer over-read (CWE-125) and does not currently have a published CVSS score, EPSS metric, or confirmed KEV status, though the underlying mechanism suggests moderate real-world risk in environments with untrusted or attacker-controlled DNS infrastructure.

RemediationAI

Apply the security patch provided by the GNU C Library project by upgrading glibc to version 2.44 or later (when released) or to a patched version of 2.43 or earlier provided by your Linux distribution. Contact your OS vendor (Debian, Ubuntu, Red Hat, etc.) for distribution-specific patches and security advisories. Until patching is possible, implement network-level mitigation by restricting DNS queries to trusted, authenticated DNS servers (e.g., your organization's internal DNS or well-maintained public resolvers like Cloudflare or Quad9), disabling unnecessary reverse DNS lookups in applications via configuration, and monitoring DNS traffic for anomalous responses. For systems with critical workloads, consider running DNS queries through a validating DNSSEC resolver which may reject malformed responses before they reach glibc.

Affected VersionsENISA

glibc 2.34 ≤2.43

Affected Packages

euvd glibc no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in glibc's DNS resolver implementation, specifically in how the gethostbyaddr and gethostbyaddr_r functions (which perform reverse DNS lookups) parse DNS protocol responses when the nsswitch.conf configuration specifies the DNS backend. The DNS protocol defines structured response sections: question, answer, authority, and additional sections. The bug allows a malformed DNS response to cause the parser to misinterpret section boundaries, treating data from non-answer sections as valid answer data. This is fundamentally a CWE-125 (Out-of-bounds Read) vulnerability where insufficient bounds checking during DNS packet parsing allows the reading of memory beyond intended buffer limits. The affected CPE is cpe:2.3:a:the_gnu_c_library:glibc:*:*:*:*:*:*:*:* for all versions from 2.34 to 2.43 inclusive. This affects any system-level application or library that relies on glibc's name resolution, making it a foundational supply-chain risk.

Know when Glibc gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (glibc) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 6.5 MEDIUM

Primary rating from Vendor (glibc).

CVSS VectorVendor: glibc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 20, 2026 - 19:59 nvd
HIGH 7.5

DescriptionCVE.org

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Executive ViewAI

Why It Matters

Organizations using the GNU C Library face notable risk from CVE-2026-4437, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Glibc

View all
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2024-2961 HIGH POC
7.3 Apr 17

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
CVE-2015-7547 HIGH POC
8.1 Feb 18

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
CVE-2023-6246 HIGH POC
8.4 Jan 31

Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
CVE-2014-5119 HIGH POC
7.5 Aug 29

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
CVE-2012-4412 HIGH POC
7.5 Oct 09

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
CVE-2018-1000001 HIGH POC
7.8 Jan 31

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
CVE-2019-9169 CRITICAL POC
9.8 Feb 26

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
CVE-2019-1010022 CRITICAL POC
9.8 Jul 15

GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2021-33574 CRITICAL POC
9.8 May 25

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
CVE-2023-25139 CRITICAL POC
9.8 Feb 03

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Debian

glibc
Release Status Fixed Version Urgency
bullseye vulnerable 2.31-13+deb11u11 -
bullseye (security) vulnerable 2.31-13+deb11u13 -
bookworm vulnerable 2.36-9+deb12u13 -
bookworm (security) vulnerable 2.36-9+deb12u7 -
trixie vulnerable 2.41-12+deb13u2 -
forky, sid vulnerable 2.42-13 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Container rancher/elemental-channel/sl-micro:6.0-baremetal Container rancher/elemental-channel/sl-micro:6.0-base Container rancher/elemental-channel/sl-micro:6.0-kvm Container rancher/elemental-channel/sl-micro:6.0-rt Container suse/sl-micro/6.0/baremetal-iso-image:2.1.4-6.152 Container suse/sl-micro/6.0/base-iso-image:2.1.4-5.152 Container suse/sl-micro/6.0/kvm-iso-image:2.1.4-6.159 Container suse/sl-micro/6.0/rt-iso-image:2.1.4-6.151 Container suse/sl-micro/6.1/baremetal-iso-image:2.2.1-5.97 Container suse/sl-micro/6.1/base-iso-image:2.2.1-5.114 Container suse/sl-micro/6.1/kvm-iso-image:2.2.1-5.127 Container suse/sl-micro/6.1/rt-iso-image:2.2.1-5.101 Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.158 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-EC2 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.125 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.142 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.156 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.88 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.112 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.114 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.102 Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro-BYOS-GCE Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.93 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4437 ADVISORY https://seclists.org/oss-sec/2026/q3/275 ADVISORY https://ubuntu.com/security/notices/USN-8611-1 ADVISORY https://vuldb.com/?id.352111 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1369/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20999/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21019/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21039/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21069/ REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://sourceware.org/bugzilla/show_bug.cgi?id=34014

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy