The Gnu C Library
Monthly
Heap buffer overflow in glibc scanf functions versions 2.7 through 2.43 allows remote unauthenticated attackers to execute arbitrary code by providing malicious input to applications using %mc format specifiers with width >1024. CVSS 9.8 indicates critical network-accessible impact, but EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation activity at time of analysis. No CISA KEV listing confirms this as a theoretical risk requiring specific application usage patterns rather than widespread active exploitation. Successful exploitation depends on target applications parsing attacker-controlled input through affected scanf family functions with specific format string configurations.
Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.
Buffer overflow in glibc's obsolete NIS authentication function allows remote attackers to compromise integrity and availability via spoofed UDP responses. Affects all glibc versions through 2.43, but exploitation requires the target application to actively use the deprecated nis_local_principal function (obsolete since glibc 2.26). EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability, consistent with the narrow attack surface of legacy NIS deployments. No active exploitation or public exploit code identified at time of analysis.
Remote denial of service in GNU C Library (glibc) 2.43 and earlier allows unauthenticated remote attackers to crash applications via malformed input during character set conversion from IBM1390 or IBM1399 encodings. The vulnerability triggers an assertion failure in the iconv() function with high attack reliability (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Proof-of-concept code exists and CISA SSVC assessment confirms the issue is automatable with partial technical impact, making this a practical denial-of-service vector for any networked application processing untrusted character encoding conversions.
A DNS response parsing vulnerability exists in the GNU C Library (glibc) versions 2.34 through 2.43 affecting the gethostbyaddr and gethostbyaddr_r functions. When a malicious or compromised DNS server returns a crafted response that violates the DNS specification, the library may incorrectly treat non-answer sections (such as authority or additional sections) as valid answers, leading to buffer overflow and information disclosure. The vulnerability is classified as a read buffer over-read (CWE-125) and does not currently have a published CVSS score, EPSS metric, or confirmed KEV status, though the underlying mechanism suggests moderate real-world risk in environments with untrusted or attacker-controlled DNS infrastructure.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.
Deprecated DNS printing functions in glibc 2.2 and later fail to validate RDATA content length for LOC, CERT, TKEY, and TSIG record types, enabling an attacker who can supply a crafted DNS response to crash affected applications or leak uninitialized memory. The affected functions - ns_printrrf, ns_printrr, and fp_nquery - are explicitly debug-only utilities outside the standard DNS resolver code path, and have been formally deprecated since glibc 2.34, substantially limiting real-world exposure. No public exploits or active exploitation have been identified (SSVC Exploitation: none; EPSS: 0.04%), and a vendor patch is available via the glibc project and Red Hat advisory RHSA-2026:12740.
The GNU C Library (glibc) versions 2.34 through 2.43 contain a vulnerability in the gethostbyaddr and gethostbyaddr_r functions that can return invalid DNS hostnames violating DNS specification requirements when using a configured nsswitch.conf with the DNS backend. This affects any application or system service relying on reverse DNS lookups through glibc, potentially leading to information disclosure or incorrect hostname resolution. While no CVSS score, EPSS probability, or active exploitation status has been publicly assigned, the vulnerability represents a data integrity issue in a foundational system library affecting millions of Linux systems.
Heap buffer overflow in glibc scanf functions versions 2.7 through 2.43 allows remote unauthenticated attackers to execute arbitrary code by providing malicious input to applications using %mc format specifiers with width >1024. CVSS 9.8 indicates critical network-accessible impact, but EPSS score of 0.02% (5th percentile) suggests minimal real-world exploitation activity at time of analysis. No CISA KEV listing confirms this as a theoretical risk requiring specific application usage patterns rather than widespread active exploitation. Successful exploitation depends on target applications parsing attacker-controlled input through affected scanf family functions with specific format string configurations.
Out-of-bounds read in GNU C Library (glibc) versions 2.1.1 through 2.43 during wide character pushback operations can cause application crashes and potential information disclosure. The ungetwc() function incorrectly operates on the regular character buffer instead of the wide-stream buffer due to an implementation bug in _IO_wdefault_pbackfail, leading to reads before allocated memory regions. While CVSS rates this 7.5 High with network vector, EPSS exploitation probability is extremely low (0.02%, 5th percentile), reflecting the highly specialized conditions required: applications must use ungetwc() with character encodings having single-byte/multi-byte overlaps (not standard Unicode sets). No active exploitation confirmed (not in CISA KEV), no public exploit code identified at time of analysis.
Buffer overflow in glibc's obsolete NIS authentication function allows remote attackers to compromise integrity and availability via spoofed UDP responses. Affects all glibc versions through 2.43, but exploitation requires the target application to actively use the deprecated nis_local_principal function (obsolete since glibc 2.26). EPSS score of 0.02% (5th percentile) indicates low real-world exploitation probability, consistent with the narrow attack surface of legacy NIS deployments. No active exploitation or public exploit code identified at time of analysis.
Remote denial of service in GNU C Library (glibc) 2.43 and earlier allows unauthenticated remote attackers to crash applications via malformed input during character set conversion from IBM1390 or IBM1399 encodings. The vulnerability triggers an assertion failure in the iconv() function with high attack reliability (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Proof-of-concept code exists and CISA SSVC assessment confirms the issue is automatable with partial technical impact, making this a practical denial-of-service vector for any networked application processing untrusted character encoding conversions.
A DNS response parsing vulnerability exists in the GNU C Library (glibc) versions 2.34 through 2.43 affecting the gethostbyaddr and gethostbyaddr_r functions. When a malicious or compromised DNS server returns a crafted response that violates the DNS specification, the library may incorrectly treat non-answer sections (such as authority or additional sections) as valid answers, leading to buffer overflow and information disclosure. The vulnerability is classified as a read buffer over-read (CWE-125) and does not currently have a published CVSS score, EPSS metric, or confirmed KEV status, though the underlying mechanism suggests moderate real-world risk in environments with untrusted or attacker-controlled DNS infrastructure.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
Stack clash vulnerability in glibc's wordexp() function allows remote attackers to exhaust thread stack space via a crafted tilde-expanded path argument. The parse_tilde internal function uses strndupa - a GNU macro that allocates directly on the stack - to extract a username from attacker-controlled input, with no bounds check on the allocation size. Any application that passes untrusted input to wordexp() is a viable exploitation vector, making the real-world impact contingent on calling application patterns rather than glibc defaults alone. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.0 score of 6.6 reflects high attack complexity due to the application-dependency prerequisite.
Deprecated DNS printing functions in glibc 2.2 and later fail to validate RDATA content length for LOC, CERT, TKEY, and TSIG record types, enabling an attacker who can supply a crafted DNS response to crash affected applications or leak uninitialized memory. The affected functions - ns_printrrf, ns_printrr, and fp_nquery - are explicitly debug-only utilities outside the standard DNS resolver code path, and have been formally deprecated since glibc 2.34, substantially limiting real-world exposure. No public exploits or active exploitation have been identified (SSVC Exploitation: none; EPSS: 0.04%), and a vendor patch is available via the glibc project and Red Hat advisory RHSA-2026:12740.
The GNU C Library (glibc) versions 2.34 through 2.43 contain a vulnerability in the gethostbyaddr and gethostbyaddr_r functions that can return invalid DNS hostnames violating DNS specification requirements when using a configured nsswitch.conf with the DNS backend. This affects any application or system service relying on reverse DNS lookups through glibc, potentially leading to information disclosure or incorrect hostname resolution. While no CVSS score, EPSS probability, or active exploitation status has been publicly assigned, the vulnerability represents a data integrity issue in a foundational system library affecting millions of Linux systems.