glibc EUVD-2026-84558

Requires local access to the host and the presence on that host of a setuid or setgid (AT_SECURE) program whose DT_RPATH or DT_RUNPATH begins with the string $ORIGIN immediately followed by a NUL byte or a '/' character; the attacker must be able to execute that specific binary so the glibc dynamic loader parses the malformed path. Exploitation is limited by the need for local privileges (PR:L), the non-universal requirement that such a specially-linked setuid/setgid binary actually exist (driving AC:H), and the modest impact ceiling - a loader crash of the invoked program plus limited memory disclosure rather than privilege escalation to root. There is no remote or unauthenticated path and no user-interaction dependency on a victim.

All signals converge on this being a LOW real-world priority despite affecting an ubiquitous product. The vendor CVSS of 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a genuinely constrained bug: local access only, high attack complexity, and partial confidentiality/integrity impact with no availability impact scored. No EPSS score, KEV listing, or POC was provided in the intelligence set, so per the precision rules there is no public exploit identified at time of analysis and no evidence of active exploitation. The most important limiter is not in the numeric vector but in the description: exploitation requires a setuid/setgid (AT_SECURE) binary whose DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by NUL or '/'. That is a specific link-time property of a target binary, not something an attacker freely controls, which justifies AC:H. The primary demonstrated impact is a loader crash of a program the attacker themselves invokes plus limited memory disclosure - the vendor's A:N (rather than A:L) is defensible because the DoS is self-inflicted rather than affecting other users or services, though the description's explicit mention of 'crash (denial of service)' makes a marginal A:L arguable. No signals conflict; the picture is internally consistent: high-footprint library, narrow exploitation surface, low impact.

A local, low-privileged attacker on a Linux host locates a setuid/setgid (AT_SECURE) binary that was linked with a DT_RPATH or DT_RUNPATH beginning with $ORIGIN followed by NUL or '/'. The attacker executes that binary so the glibc dynamic loader parses the malformed path, over-reading the path buffer and over-writing a stack-allocated internal buffer, causing a loader crash and limited disclosure of adjacent process memory. No public exploit code was identified in the provided intelligence, and the high complexity (AC:H) is driven by the requirement that such a specifically-linked setuid binary exist on the system.