relibc EUVD-2026-67770

Exploitation requires three simultaneous conditions: the target application must be compiled against relibc at or before commit 61f42d; the application must be network-accessible and must expose a code path that calls seekdir() in /dirent/mod.rs with attacker-influenced directory position data; and the runtime environment must use relibc as its C library (primarily Redox OS). The CVSS PR:N indicates no authentication is required at the library level, but the attacker's input must travel through an application layer that reaches the seekdir() call - this is application-specific and not guaranteed by the library's mere presence. Exploitation is limited to environments running relibc; all deployments using glibc, musl, or other libc implementations are not affected. Non-default configuration or specific application design is implicitly required for the network attack vector to be valid.

The CVSS 7.5 HIGH score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) implies unauthenticated, low-complexity remote exploitation, which warrants independent scrutiny for a library-level vulnerability: relibc itself does not open sockets or accept network connections - exploitation depends entirely on whether a calling application exposes a code path through seekdir() to attacker-controlled input over a network interface, which is an application-specific condition the CVSS vector does not reflect. This makes AC:L an overstatement relative to the actual attack surface. No EPSS score was provided in the input, so exploitation probability cannot be quantified from that signal. The public PoC lowers the bar for attempts, but the Redox OS ecosystem has a negligible production footprint compared to mainstream Linux distributions, substantially limiting aggregate real-world impact. No confirmed active exploitation (no CISA KEV listing) and the niche deployment environment suggest this is a moderate operational priority for the narrow audience actually running relibc-linked software, and a low priority for most enterprise environments that use glibc or musl. The CVSS vector and description show a tension: the description implies a library-local triggering condition, while the vector asserts network exploitability without qualification - defenders should verify with the Redox OS maintainers whether a realistic network-reachable attack path has been demonstrated.

An attacker targets a network-accessible application (such as a file-serving daemon or FTP server) built against the vulnerable relibc on Redox OS, sending a crafted request that causes the application to call seekdir() with a malformed or adversarially chosen directory offset. The seekdir() implementation enters a resource-exhausting state - unbounded loop or excessive allocation - causing the application process to consume all available CPU or memory and crash, denying service to legitimate users. A public proof-of-concept demonstrating this behavior is available at https://github.com/Marsman1996/pocs/tree/master/redox/CVE-2026-38636.