The Gnu C Library
Monthly
Path traversal in the GNU C Library gettext implementation lets an attacker who can set the LANGUAGE environment variable make any gettext-using program load an attacker-supplied .mo message catalog from an arbitrary filesystem location, even though the earlier CVE-2014-0475 fix blocked '..' components in the locale variables. A crafted catalog can crash the target through out-of-range offsets or supply translations whose printf format directives do not match the program's arguments, producing undefined behaviour that may escalate to code execution with the program's privileges. Exploitation is conditional: the program must not be running AT_SECURE (setuid/setgid, which rejects such LANGUAGE entries), the environment must cross a trust boundary (the description's example is an SSH server with AcceptEnv accepting LANGUAGE and LANG for an account limited to a forced command), a non-C/POSIX LC_MESSAGES locale must also be selectable, and the crafted .mo file must be readable by the target. The vendor advisory GLIBC-SA-2026-0025 is published, the assigned CVSS is 7.0 with AV:L/AC:H/PR:L, and no public exploit code has been identified at time of analysis; the priority signal is to address this within the current week rather than as an emergency.
Heap buffer overflow in glibc scanf functions versions 2.7 through 2.43 allows remote unauthenticated attackers to execute arbitrary code by providing malicious input to applications using %mc format specifiers with width >1024. CVSS 9.8 indicates critical network-accessible impact, but EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation activity at time of analysis. No CISA KEV listing confirms this as a theoretical risk requiring specific application usage patterns rather than widespread active exploitation. Successful exploitation depends on target applications parsing attacker-controlled input through affected scanf family functions with specific format string configurations.
Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.
Buffer overflow in glibc's obsolete NIS authentication function allows remote attackers to compromise integrity and availability via spoofed UDP responses. Affects all glibc versions through 2.43, but exploitation requires the target application to actively use the deprecated nis_local_principal function (obsolete since glibc 2.26). EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability, consistent with the narrow attack surface of legacy NIS deployments. No active exploitation or public exploit code identified at time of analysis.
Remote denial of service in GNU C Library (glibc) 2.43 and earlier allows unauthenticated remote attackers to crash applications via malformed input during character set conversion from IBM1390 or IBM1399 encodings. The vulnerability triggers an assertion failure in the iconv() function with high attack reliability (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Proof-of-concept code exists and CISA SSVC assessment confirms the issue is automatable with partial technical impact, making this a practical denial-of-service vector for any networked application processing untrusted character encoding conversions.
A DNS response parsing vulnerability exists in the GNU C Library (glibc) versions 2.34 through 2.43 affecting the gethostbyaddr and gethostbyaddr_r functions. When a malicious or compromised DNS server returns a crafted response that violates the DNS specification, the library may incorrectly treat non-answer sections (such as authority or additional sections) as valid answers, leading to buffer overflow and information disclosure. The vulnerability is classified as a read buffer over-read (CWE-125) and does not currently have a published CVSS score, EPSS metric, or confirmed KEV status, though the underlying mechanism suggests moderate real-world risk in environments with untrusted or attacker-controlled DNS infrastructure.
Power8-optimized strncasecmp in the GNU C Library (glibc) 2.24 and later can read one byte past the caller-supplied length limit, faulting only when the compared strings match up to the final byte of a memory page and the adjacent page is unmapped or non-readable, which crashes the calling process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), the flaw is reachable by unauthenticated remote attackers only in applications that pass attacker-controlled strings into strncasecmp, and impact is confined to a low-availability denial of service of that process - no code execution, data disclosure, or modification. Exploitation additionally requires the specific IBM POWER8 CPU family and precise page-boundary alignment, making triggering non-deterministic; no public exploit has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV). Overall this is a low-severity availability-only bug that is not a priority for most environments.
The GNU C Library dynamic loader (ld.so) in glibc 2.14 through 2.44 mishandles DT_RPATH/DT_RUNPATH values that begin with the literal string $ORIGIN immediately followed by a NUL byte or a '/' character, producing a stack-based buffer overflow (CWE-121) when such a path is parsed in a setuid or setgid (AT_SECURE) program. A local attacker who can execute an affected privileged binary causes the loader to read past the end of the path buffer and write past the end of a stack-allocated internal buffer, resulting in a loader crash (denial of service) and limited disclosure of process memory, with a low CVSS 3.6 score reflecting the local, high-complexity, non-privilege-escalating nature of the flaw. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation requires local access (PR:L) plus the pre-existing, non-universal condition that a specially-linked setuid/setgid binary exists on the host and is executable by the attacker, which is why all signals converge on this being a LOW real-world priority despite the ubiquity of glibc.
Privilege escalation in GNU C Library (glibc) 2.14 through 2.44 stems from a TOCTOU race in ld.so when expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs. A local low-privileged (PR:L) attacker can exploit this only where fs.protected_hardlinks is disabled and a suitable setuid/setgid binary exists, by hard-linking the binary and winning a race to swap an intermediate path component for a symlink so the loader loads an attacker-controlled shared object with the program's elevated privileges. No public exploit identified at time of analysis; major Linux distributions enable fs.protected_hardlinks by default, sharply limiting exposure.
Denial of service in the GNU C Library (glibc) DNS stub resolver causes any process that resolves names to abort via an assertion failure when the search list loaded from /etc/resolv.conf or the LOCALDOMAIN environment variable contains a single domain of roughly 200 characters or more; affected versions are 2.26 through 2.44. The weakness is reachable by an unauthenticated attacker on the adjacent network (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.3) only where search domains are populated from attacker-influenced DHCP or VPN configuration and the network-configuration software does not reject the over-length value; local exploitation requires the ability to write /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to process termination (no code execution, data disclosure, or integrity impact), and no public exploit code was identified at time of analysis.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.
Deprecated DNS printing functions in glibc 2.2 and later fail to validate RDATA content length for LOC, CERT, TKEY, and TSIG record types, enabling an attacker who can supply a crafted DNS response to crash affected applications or leak uninitialized memory. The affected functions - ns_printrrf, ns_printrr, and fp_nquery - are explicitly debug-only utilities outside the standard DNS resolver code path, and have been formally deprecated since glibc 2.34, substantially limiting real-world exposure. No public exploits or active exploitation have been identified (SSVC Exploitation: none; EPSS: 0.04%), and a vendor patch is available via the glibc project and Red Hat advisory RHSA-2026:12740.
The GNU C Library (glibc) versions 2.34 through 2.43 contain a vulnerability in the gethostbyaddr and gethostbyaddr_r functions that can return invalid DNS hostnames violating DNS specification requirements when using a configured nsswitch.conf with the DNS backend. This affects any application or system service relying on reverse DNS lookups through glibc, potentially leading to information disclosure or incorrect hostname resolution. While no CVSS score, EPSS probability, or active exploitation status has been publicly assigned, the vulnerability represents a data integrity issue in a foundational system library affecting millions of Linux systems.
Path traversal in the GNU C Library gettext implementation lets an attacker who can set the LANGUAGE environment variable make any gettext-using program load an attacker-supplied .mo message catalog from an arbitrary filesystem location, even though the earlier CVE-2014-0475 fix blocked '..' components in the locale variables. A crafted catalog can crash the target through out-of-range offsets or supply translations whose printf format directives do not match the program's arguments, producing undefined behaviour that may escalate to code execution with the program's privileges. Exploitation is conditional: the program must not be running AT_SECURE (setuid/setgid, which rejects such LANGUAGE entries), the environment must cross a trust boundary (the description's example is an SSH server with AcceptEnv accepting LANGUAGE and LANG for an account limited to a forced command), a non-C/POSIX LC_MESSAGES locale must also be selectable, and the crafted .mo file must be readable by the target. The vendor advisory GLIBC-SA-2026-0025 is published, the assigned CVSS is 7.0 with AV:L/AC:H/PR:L, and no public exploit code has been identified at time of analysis; the priority signal is to address this within the current week rather than as an emergency.
Heap buffer overflow in glibc scanf functions versions 2.7 through 2.43 allows remote unauthenticated attackers to execute arbitrary code by providing malicious input to applications using %mc format specifiers with width >1024. CVSS 9.8 indicates critical network-accessible impact, but EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation activity at time of analysis. No CISA KEV listing confirms this as a theoretical risk requiring specific application usage patterns rather than widespread active exploitation. Successful exploitation depends on target applications parsing attacker-controlled input through affected scanf family functions with specific format string configurations.
Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.
Buffer overflow in glibc's obsolete NIS authentication function allows remote attackers to compromise integrity and availability via spoofed UDP responses. Affects all glibc versions through 2.43, but exploitation requires the target application to actively use the deprecated nis_local_principal function (obsolete since glibc 2.26). EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability, consistent with the narrow attack surface of legacy NIS deployments. No active exploitation or public exploit code identified at time of analysis.
Remote denial of service in GNU C Library (glibc) 2.43 and earlier allows unauthenticated remote attackers to crash applications via malformed input during character set conversion from IBM1390 or IBM1399 encodings. The vulnerability triggers an assertion failure in the iconv() function with high attack reliability (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Proof-of-concept code exists and CISA SSVC assessment confirms the issue is automatable with partial technical impact, making this a practical denial-of-service vector for any networked application processing untrusted character encoding conversions.
A DNS response parsing vulnerability exists in the GNU C Library (glibc) versions 2.34 through 2.43 affecting the gethostbyaddr and gethostbyaddr_r functions. When a malicious or compromised DNS server returns a crafted response that violates the DNS specification, the library may incorrectly treat non-answer sections (such as authority or additional sections) as valid answers, leading to buffer overflow and information disclosure. The vulnerability is classified as a read buffer over-read (CWE-125) and does not currently have a published CVSS score, EPSS metric, or confirmed KEV status, though the underlying mechanism suggests moderate real-world risk in environments with untrusted or attacker-controlled DNS infrastructure.
Power8-optimized strncasecmp in the GNU C Library (glibc) 2.24 and later can read one byte past the caller-supplied length limit, faulting only when the compared strings match up to the final byte of a memory page and the adjacent page is unmapped or non-readable, which crashes the calling process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), the flaw is reachable by unauthenticated remote attackers only in applications that pass attacker-controlled strings into strncasecmp, and impact is confined to a low-availability denial of service of that process - no code execution, data disclosure, or modification. Exploitation additionally requires the specific IBM POWER8 CPU family and precise page-boundary alignment, making triggering non-deterministic; no public exploit has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV). Overall this is a low-severity availability-only bug that is not a priority for most environments.
The GNU C Library dynamic loader (ld.so) in glibc 2.14 through 2.44 mishandles DT_RPATH/DT_RUNPATH values that begin with the literal string $ORIGIN immediately followed by a NUL byte or a '/' character, producing a stack-based buffer overflow (CWE-121) when such a path is parsed in a setuid or setgid (AT_SECURE) program. A local attacker who can execute an affected privileged binary causes the loader to read past the end of the path buffer and write past the end of a stack-allocated internal buffer, resulting in a loader crash (denial of service) and limited disclosure of process memory, with a low CVSS 3.6 score reflecting the local, high-complexity, non-privilege-escalating nature of the flaw. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation requires local access (PR:L) plus the pre-existing, non-universal condition that a specially-linked setuid/setgid binary exists on the host and is executable by the attacker, which is why all signals converge on this being a LOW real-world priority despite the ubiquity of glibc.
Privilege escalation in GNU C Library (glibc) 2.14 through 2.44 stems from a TOCTOU race in ld.so when expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs. A local low-privileged (PR:L) attacker can exploit this only where fs.protected_hardlinks is disabled and a suitable setuid/setgid binary exists, by hard-linking the binary and winning a race to swap an intermediate path component for a symlink so the loader loads an attacker-controlled shared object with the program's elevated privileges. No public exploit identified at time of analysis; major Linux distributions enable fs.protected_hardlinks by default, sharply limiting exposure.
Denial of service in the GNU C Library (glibc) DNS stub resolver causes any process that resolves names to abort via an assertion failure when the search list loaded from /etc/resolv.conf or the LOCALDOMAIN environment variable contains a single domain of roughly 200 characters or more; affected versions are 2.26 through 2.44. The weakness is reachable by an unauthenticated attacker on the adjacent network (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.3) only where search domains are populated from attacker-influenced DHCP or VPN configuration and the network-configuration software does not reject the over-length value; local exploitation requires the ability to write /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to process termination (no code execution, data disclosure, or integrity impact), and no public exploit code was identified at time of analysis.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.
Deprecated DNS printing functions in glibc 2.2 and later fail to validate RDATA content length for LOC, CERT, TKEY, and TSIG record types, enabling an attacker who can supply a crafted DNS response to crash affected applications or leak uninitialized memory. The affected functions - ns_printrrf, ns_printrr, and fp_nquery - are explicitly debug-only utilities outside the standard DNS resolver code path, and have been formally deprecated since glibc 2.34, substantially limiting real-world exposure. No public exploits or active exploitation have been identified (SSVC Exploitation: none; EPSS: 0.04%), and a vendor patch is available via the glibc project and Red Hat advisory RHSA-2026:12740.
The GNU C Library (glibc) versions 2.34 through 2.43 contain a vulnerability in the gethostbyaddr and gethostbyaddr_r functions that can return invalid DNS hostnames violating DNS specification requirements when using a configured nsswitch.conf with the DNS backend. This affects any application or system service relying on reverse DNS lookups through glibc, potentially leading to information disclosure or incorrect hostname resolution. While no CVSS score, EPSS probability, or active exploitation status has been publicly assigned, the vulnerability represents a data integrity issue in a foundational system library affecting millions of Linux systems.