EUVD-2026-75897
GHSA-gwqp-9qgw-c5pv
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
AV:A reflects that exploitation flows through control of the DNS server queried by the target; AC:H for the requirement of an atypical name server producing oversized records; I:L and A:L for theoretical cache corruption and performance degradation respectively.
Primary rating from Vendor (glibc).
CVSS VectorVendor: glibc
Lifecycle Timeline
4DescriptionCVE.org
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.
There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.
Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.
AnalysisAI
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous preconditions: first, the nscd service must be actively running on the target host - nscd is not universally enabled by default across all modern Linux distributions and must be explicitly started or configured to start at boot; second, the system must use an untrusted DNS server capable of returning DNS records large enough to overflow the nscd thread stack, which the upstream description notes that bind9 could not achieve during testing, meaning the exploiting name server must be a custom, atypical, or attacker-controlled implementation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.2 score with AV:A/AC:H accurately reflects the tightly constrained real-world risk: an attacker must either control the DNS server the target system queries or have already compromised it, a high-complexity precondition that eliminates opportunistic mass exploitation - even a mid-sized municipal IT team in inowroclaw would face minimal realistic exposure unless their systems route DNS through an untrusted or externally-controlled upstream resolver. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream glibc fix referenced in GLIBC-SA-2026-0016 (https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016) and monitor your Linux distribution's security channel for the corresponding backported package update; the exact patched version must be confirmed via your distribution vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
Vendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 2.36-9+deb12u14 | - |
| bookworm (security) | vulnerable | 2.36-9+deb12u7 | - |
| trixie | vulnerable | 2.41-12+deb13u3 | - |
| forky | vulnerable | 2.43-4 | - |
| sid | vulnerable | 2.43-5 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today