Skip to main content

GNU C Library (glibc) EUVDEUVD-2026-23977

| CVE-2026-5358 CRITICAL
Classic Buffer Overflow (CWE-120)
2026-04-20 glibc
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SUSE
CRITICAL
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

6
Patch released
Apr 29, 2026 - 02:30 nvd
Patch available
Analysis Generated
Apr 21, 2026 - 20:23 vuln.today
CVSS changed
Apr 21, 2026 - 20:22 NVD
9.1 (CRITICAL)
EUVD ID Assigned
Apr 20, 2026 - 21:15 euvd
EUVD-2026-23977
Analysis Generated
Apr 20, 2026 - 21:15 vuln.today
CVE Published
Apr 20, 2026 - 20:37 nvd
CRITICAL 9.1

DescriptionCVE.org

The obsolete nis_local_principal function in the GNU C Library version 2.43 and older may overflow a buffer in the data section, which could allow an attacker to spoof a crafted response to a UDP request generated by this function and overwrite neighboring static data in the requesting application.

NIS support is obsolete and has been deprecated in the GNU C Library since version 2.26 and is only maintained for legacy usage. Applications should port away from NIS to more modern identity and access management services.

AnalysisAI

Buffer overflow in glibc's obsolete NIS authentication function allows remote attackers to compromise integrity and availability via spoofed UDP responses. Affects all glibc versions through 2.43, but exploitation requires the target application to actively use the deprecated nis_local_principal function (obsolete since glibc 2.26). EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability, consistent with the narrow attack surface of legacy NIS deployments. No active exploitation or public exploit code identified at time of analysis.

Technical ContextAI

The nis_local_principal function is part of glibc's Network Information Service (NIS) implementation, a legacy client-server directory service protocol dating from the 1980s that operates over UDP. This function handles principal name resolution for NIS authentication requests. The vulnerability (CWE-120: Buffer Copy without Checking Size of Input) occurs when the function receives a crafted UDP response packet that exceeds the allocated buffer in the data section, allowing an attacker positioned on the network path to overwrite adjacent static variables in the calling application's memory space. NIS has been deprecated in glibc since version 2.26 (released 2017) due to fundamental security limitations including lack of encryption and weak authentication, yet remains compiled-in for legacy compatibility. Modern applications should use LDAP, Kerberos, SSSD, or cloud-based identity services instead.

RemediationAI

Primary fix: Upgrade to glibc version 2.44 or later once released (check https://sourceware.org/bugzilla/show_bug.cgi?id=34067 for patch status and release timeline). Most distributions will issue updated glibc packages through their security update channels. If immediate patching is not feasible and the application genuinely requires NIS functionality, implement network-level mitigations: restrict NIS traffic to dedicated management VLANs using firewall rules blocking UDP ports 111 (portmapper) and dynamically-assigned NIS ports from untrusted networks. Deploy static ARP entries and port security on switches to prevent ARP spoofing attacks that enable UDP response interception. Monitor for anomalous NIS traffic patterns. Long-term remediation: migrate away from NIS entirely to modern identity management solutions like FreeIPA with SSSD (Red Hat/CentOS/Fedora), LDAP with Kerberos authentication, Active Directory integration via Samba/Winbind, or cloud-based directory services (Azure AD, Okta). Note that network isolation trades off operational complexity and may break legitimate NIS functionality if not carefully scoped.

More in Glibc

View all
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2015-7547 HIGH POC
8.1 Feb 18

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C

CVE-2023-6246 HIGH POC
8.4 Jan 31

Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r

CVE-2014-5119 HIGH POC
7.5 Aug 29

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe

CVE-2012-4412 HIGH POC
7.5 Oct 09

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende

CVE-2018-1000001 HIGH POC
7.8 Jan 31

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th

CVE-2023-25139 CRITICAL POC
9.8 Feb 03

sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct

CVE-2021-33574 CRITICAL POC
9.8 May 25

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve

CVE-2019-1010022 CRITICAL POC
9.8 Jul 15

GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2019-9169 CRITICAL POC
9.8 Feb 26

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove

CVE-2017-1000366 HIGH POC
7.8 Jun 19

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

CVE-2014-9402 HIGH POC
7.8 Feb 24

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Se

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

EUVD-2026-23977 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy